[HYPERSHELL-104] feat(kind): add optimized Keycloak image for faster startup

[rh-amarin]

Summary

• Add a multi-stage Dockerfile (deploy/kind/keycloak/Dockerfile) that pre-builds Keycloak providers at image time, then starts with --optimized to cut pod startup from ~60s to ~15s
• Gate the optimization behind KIND_KEYCLOAK_OPTIMIZED env var (default false) using a kustomize overlay (deploy/kind-keycloak-optimized/) on top of the stock deploy/kind/ base
• Add make kind-keycloak-build target for manual image rebuilds

Test plan

• make kind-up — verify stock Keycloak starts normally (default behavior unchanged)
• KIND_KEYCLOAK_OPTIMIZED=true make kind-up — verify optimized image is built, loaded, and Keycloak starts with --optimized in ~15s
• make kind-keycloak-build — verify manual image rebuild works
• kustomize build deploy/kind — verify base overlay renders valid YAML
• kustomize build deploy/kind-keycloak-optimized — verify optimized overlay renders valid YAML with correct args, env vars, and image override

JIRA: https://redhat.atlassian.net/browse/HYPERSHELL-104

🤖 Generated with Claude Code

[jsell-rh]

PR #140 renders a valid optimized Keycloak overlay and the focused image build/start test succeeds, but the change is not merge-ready. The new Dockerfile violates required dependency pinning, the opt-in behavior contradicts the updated desired-state documentation, and CI does not exercise the enabled path.

Major

1. deploy/kind/keycloak/Dockerfile:1,7 — Both base stages use the mutable 26.2 tag, and the required repository-policy check fails on both lines. Pin both stages to the existing Keycloak digest; confidence: High (100%).

2. DEVELOPMENT.md:32,129-135 and specs/platform/local-development.spec.md:30,700,731 — These statements say normal make kind-up uses, builds, and starts the optimized image, while KIND_KEYCLOAK_OPTIMIZED defaults to false. Either make optimization the default or qualify the docs/spec everywhere as opt-in; confidence: High (98%).

3. scripts/kind/up.sh:243-259 — The enabled branch has no automated coverage; the successful E2E check executes the default disabled path. Add a check that renders the overlay and asserts the image, args, and env, plus coverage for selecting the optimized branch; confidence: High (95%).

Minor

1. Commit a37ba61 starts with [HYPERSHELL-104] rather than the required type(scope): description form. Rename the squash title to begin with feat(kind):; confidence: Medium (80%) because recent repository history contains mixed precedent.

Overall assessment: REQUEST_CHANGES

Findings Summary (ordered by severity, highest first):

1. [Major] Pin both Keycloak base-image stages by digest - Dependency Pinning (L1, L7)
2. [Major] Align unconditional optimized-Keycloak documentation with the opt-in default - Spec Consistency (L32, L129-L135; L30, L700, L731)
3. [Major] Add automated coverage for the enabled optimization path - Test Coverage (L243-L259)
4. [Minor] Use the required conventional squash-commit title - Commit Discipline (commit a37ba61)

Convention Checklist (omit conventions not applicable to the diff):

Convention	Result
External image dependencies pinned by digest	Fail
SecurityContext on all pod specs	Pass
Resource limits/requests on containers	Pass
Image references consistent across manifests	Pass
Conventional commit message	Fail

[jsell-rh]

[Major] Pin both Keycloak base stages. Lines 1 and 7 use the mutable 26.2 tag, so make check fails the required dependency-pin policy. Pin both FROM lines to the existing Keycloak digest, quay.io/keycloak/keycloak:26.2@sha256:e1bea10dc9a144b0f70aba477ba2ef14a0fa752e7e95faa4b7903ffa1287187a. Confidence: High (100%).

[jsell-rh]

[Major] Align this with the opt-in default. KIND_KEYCLOAK_OPTIMIZED defaults to false, so normal make kind-up uses the stock image, but this paragraph, the setup list, and the updated spec state unconditionally that kind-up builds and uses the optimized image. Either change the default to true or qualify every affected statement with KIND_KEYCLOAK_OPTIMIZED=true. Confidence: High (98%).

[jsell-rh]

[Major] Add automated coverage for the enabled path. The successful E2E job executes the default false branch, and no test references this flag or overlay. Add a policy/test check that renders both overlays and asserts the optimized image, start --optimized args, and required env; coverage for branch selection and archive loading would also protect this shell path. The focused manual build/start passed, but regressions here will not be caught. Confidence: High (95%).