fix(egress): make credential vault mutations immediately visible

[Gujiassh]

Summary

• make successful Credential Vault create, patch, and delete responses visible to the next intercepted flow
• replace the 0.5-second cache window with a private conditional lookup: 304 reuses the snapshot, 200 validates and replaces it, and 404 alone means no active vault
• use an opaque mutation tag because delete and recreate can reuse public revision 1
• clear cached plaintext and fail closed on transport, status, ETag, revision, or deep-schema failures; buffered requests receive 503, while streamed requests terminate before upstream forwarding

Why

#1281 removes an unrelated one-second execd delay. An immediate request can therefore reuse the pre-mutation egress snapshot after the Credential Vault mutation returned success.

The Store publishes the tag with mutation state under one lock. Conditional comparison and snapshot rendering share one read lock, preventing mixed-version responses.

Relationship to #1636

This overlaps #1636 only in fail-closed lookup handling. The main change is the ACK-visibility protocol across the Go Store, sidecar/fleet handlers, per-client fleet cache, and Python addon. It also covers malformed payloads, cache clearing, status preservation, streamed-body termination, and operator documentation. It stays separate from #1281 so its approved execd scope remains unchanged.

Validation

• 75 Python tests passed; 6 Windows skips require Ubuntu (mitmdump/AF_UNIX)
• changed-file Ruff passed except two excluded pre-existing simplification findings
• Linux-target Go test binaries cross-compiled; scoped go vet passed
• VitePress build and git diff --check passed
• independent Critical review: ACCEPT

CI required before merge

Please require native Ubuntu egress/mitmdump/AF_UNIX tests, fleet smoke, native Go checks, and Docker-bridge multilingual Credential Vault E2E.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T23:42:56.811005Z	13e8963	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Pangjiping]

LGTM. @jwx0925 ptal