sync: fork main with upstream KafScale/platform (our fixes now merged upstream)

[kamir]

Syncs the DISTRO build-source fork with upstream/main (d10e069).

Why

Upstream now carries our merged contributions plus the maintainer's fixes. This brings the fork's main (the DISTRO image build source) up to date so builds pick up everything.

What upstream now has (was ours, merged upstream)

• fix(proxy): strip double length-prefix on fetch/produce fan-out re-marshal KafScale/platform#157 proxy: strip double length-prefix on fetch/produce fan-out re-marshal
• fix(storage): serve the write buffer on read so acked records are consumable (read-after-ack) KafScale/platform#149 storage: serve write buffer on read (read-after-ack)
• feat: soft pod anti-affinity for broker, etcd, and proxy KafScale/platform#153 soft pod anti-affinity (broker/etcd/proxy)
• feat(chart): PodSecurity 'restricted'-compatible securityContext on workloads KafScale/platform#152 PSA restricted-compatible securityContext
• fix(operator): etcd compaction, maintenance jobs, and alerts KafScale/platform#151 operator etcd compaction/maintenance
• fix(chart): proxy service honors service.nodePort KafScale/platform#150 proxy service honors service.nodePort

Plus maintainer fixes

KafScale#156, KafScale#158/159, KafScale#160, KafScale#162 (etcd snapshot serialize), KafScale#165 (persistMu), KafScale#166 (sec fixes), KafScale#167, KafScale#168.

Conflict resolution

All conflicts were in examples/ (add/add) + .gitignore. Took upstream's versions , they are our example collection after a review pass adding Apache license headers. Fork-unique content (WritingOS agents/claims/docuflow/tasks, hack/) merged cleanly and is preserved. Core files took upstream verbatim. Core builds green.

Not in this PR

Our readyz fetch-roundtrip gate (BUG-0026) is intentionally kept out; it lands as a thin patch layer on top for the rc2 build, and should be re-filed as an upstream PR (ADR-0008).

🤖 Generated with Claude Code

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[kamir]

CodeQL check ("29-31 new alerts, 8 high") is non-blocking for this sync , evidence:

• git diff upstream/main -- '*.go' = 0 files. The Go code in this branch is byte-identical to upstream/main. Every high alert (go/clear-text-logging in cmd/broker, cmd/proxy, pkg/broker; go/incorrect-integer-conversion in cmd/proxy) sits in code that is verbatim upstream , so these are pre-existing upstream findings, not introduced by this PR.
• CodeQL's own note confirms it: "Alerts not introduced by this pull request might have been detected because the code changes were too large." This is the large-diff (74-commit sync) heuristic re-attributing upstream alerts.
• All functional gates pass: Go Test Suite green; coverage 78.6% locally (min 45%); License Header + Helm Lint green. CodeQL is not a required check (PR is MERGEABLE).

Merging the sync. The upstream CodeQL findings are tracked as a separate follow-up (worth raising upstream; the 2 integer-conversion ones in cmd/proxy get a look when the readyz patch layer lands on top).