Epic: extract shared code into ExtraToast repos + version-pinned deploys

[jorisjonkers-dev-agents]

Program to extract code shared between personal-stack and website into standalone ExtraToast repos, distributed as published artifacts, to stop re-inventing CI/testing/setup and get proper alignment. Source: council run `.council/runs/20260608-072944-*`.

Scope decisions (operator-approved)

• personal-stack is migrated first; website follows later.
• Distribution: Maven (`dev.extratoast.*`) + npm (`@extratoast`) on GitHub Packages; reusable actions via pinned `uses:`; images on `ghcr.io/extratoast`.
• Ownership: all shared repos under `ExtraToast`; personal-stack is canonical source.

Cross-cutting requirements

• One CI pipeline per repo ending in a single `Pipeline Complete` job (the only required status check; enforced by the common ruleset). Every gating job feeds the aggregator via `needs:`.
• Common branch ruleset on every repo (squash-only, linear history, `Pipeline Complete` required) — see `ExtraToast/repo-template`.
• Versioning (corrected): personal-stack stays continuously deployed (Flux reconciles main, Keel auto-rolls in-house :latest); it is NOT version-pinned/tag-deployed. SemVer versioning + Renovate pinning apply to the sub-packages the platform consumes: extracted shared libs/tooling, reusable workflows (ExtraToast/github-workflows), and the future API/frontend pair repos (each independently versioned). A Renovate bump → merge → Keel auto-roll.
• Dependency pinning: central Gradle `libs.versions.toml` + pinned npm manifest as the single source of truth for shared-dep versions; Renovate opens exact-version bump PRs gated by `Pipeline Complete`.
• Tracking: every PR references its tracking issue and milestone.

Repositories

gradle-conventions · github-workflows · kotlin-spring-commons · vue-web-commons · openapi-client-gradle · api-contract-checks · agent-kit · stalwart-provisioner · platform-blueprints · deploy-config-schema · authz-model · repo-template

Tracking

Children are listed below and grouped by milestone M0–M6. M0 unblocks the rest.

Children

• Enable workflows permission end-to-end #606 workflows-permission (PR feat(agent-token): request workflows, issues, packages:read in minted tokens #620 — merged/deployed)
• repo-template + apply common ruleset to all ExtraToast repos #607 (template merged; ruleset rollout = operator) repo-template + ruleset
• personal-stack: consolidate CI into a single Pipeline Complete pipeline #608 Pipeline Complete CI
• [~] personal-stack: tag->release + Flux version-pinning, drop Keel :latest #609 (scaffold merged; Flux pinning + Keel removal HELD til first versioned images) versioned release/deploy
• personal-stack: central version catalog + Renovate for shared deps #610 (Renovate done; libs.versions.toml adoption waits on M1 artifacts) version catalog + Renovate
• Extract gradle-conventions + personal-stack adopt #611 gradle-conventions
• Extract github-workflows (actions + reusable workflows) + personal-stack adopt #612 github-workflows
• Extract kotlin-spring-commons (modular) + reconcile + personal-stack adopt #613 kotlin-spring-commons
• Extract vue-web-commons (npm) + personal-stack adopt #614 vue-web-commons
• OpenAPI: openapi-client-gradle + api-contract-checks + personal-stack adopt #615 openapi tooling
• Extract agent-kit + personal-stack adopt #616 agent-kit
• Extract stalwart-provisioner + personal-stack adopt #617 stalwart-provisioner
• Extract homelab-platform-blueprints + personal-stack adopt #618 platform-blueprints
• Split API+frontend service pairs into independently-versioned repos #625 API/frontend pair split (future, M7)
• Design deploy-config-schema + authz-model #619 deploy-schema + authz design