- LookupConfig: ssl-client-cert / ssl-cert-chain-prefix /
certificate-chain-length now fall back to the built-in nginx
provider's settings (Config scope, then KC_SPI_X509CERT_LOOKUP_NGINX_*
env vars), so switching the provider to "hybrid" needs no duplicated
Helm values. Explicit hybrid-scope settings still override.
- Add LookupConfigTest covering inheritance, override, and defaults
(14 tests total, all passing).
- Add RUNBOOK.md: phase-by-phase deployment procedure sized to 30-min
test windows, with verification checklists, forged-header negative
test, rollback per phase, and failure triage table.
- README/Dockerfile.example updated to match; stop tracking target/
build output (.gitignore added).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
