docs: shared-extraction handoff dossier

[jorisjonkers-dev-agents]

This PR adds the complete handoff dossier (docs/handoff/shared-extraction/) for the shared-code extraction program. The next agent should start from the verbatim instruction below.

You are continuing the ExtraToast shared-code extraction program. Scope: migrate personal-stack ONLY; website is a separate later program.

STEP 0 — Orient. Read docs/handoff/shared-extraction/ in ExtraToast/personal-stack in this order: README.md, council-brief.md, council-consolidated-plan.md, council-tasks.json, PLAN.md, REPO-TEMPLATE.md, ISSUES.md, VERSIONING.md, CI-PIPELINE-COMPLETE.md, ENVIRONMENT-AND-BLOCKERS.md, NEXT-STEPS.md. Use NEXT-STEPS.md as your task list and ISSUES.md as the status source of truth — the automation token CANNOT edit or comment GitHub issues, so track status in ISSUES.md and update it in your PRs. Epic is #605; milestones M0–M6 are #2–#8; tracking issues are #606–#619.

STEP 1 — Check the gate before any GitHub work. Read ENVIRONMENT-AND-BLOCKERS.md. Verify your minted token now carries workflows+issues by pushing a trivial change to a .github/workflows file on a throwaway branch. If it is rejected, STOP and tell the operator: PR #620 must be merged, the App's repository permissions (Issues/Workflows: read+write, Packages: read) approved on each installation, assistant-api deployed, and the cached runner token dropped (/tmp/.gh-app-token or recreate the Pod). Do NOT request Administration; do NOT request Packages:write.

STEP 2 — Execute M0 (unblocks everything), in order:
  (#607) Activate repo-template's staged workflows: git mv .github/workflows-pending/{ci.yml,release.yml} into .github/workflows/, remove the pending README, push, merge ExtraToast/repo-template#1. Confirm the operator has applied the common ruleset to every ExtraToast repo.
  (#608) Consolidate personal-stack CI (fast/full/contract-validate/migration-guard/vault-bootstrap-validate) into ONE pull_request-triggered ci.yml whose terminal job is named exactly "Pipeline Complete" (if: always(), needs: every gating job, re-actors/alls-green). Keep nightly/build-publish/prod-smoke/crac-train separate and non-gating. Open PR. Once green, personal-stack PRs can merge.
  (#610) Add gradle/libs.versions.toml (dev.extratoast.* coords) + a pinned npm manifest (@extratoast/*) + Renovate (group ExtraToast artifacts, rangeStrategy pin, gate on Pipeline Complete).
  (#609) Implement tag->release with release-please (vX.Y.Z), build version-tagged images, make a release PR bump EXPLICIT image tags in platform/cluster/flux/**, and remove keel.sh/policy:force + :latest from in-house Deployments. Deploy = reconcile the tag; rollback = git revert. Leave third-party images alone.

STEP 3 — Extractions in council DAG order (council-tasks.json):
  M1: gradle-conventions (#611) then github-workflows (#612); personal-stack adopts pinned plugin coords + pinned reusable workflows.
  M2: kotlin-spring-commons (#613) — reconcile website's diverged vault + typed CommandBus FIRST; split into modules; defer messaging; Dockerfiles resolve packages instead of copying libs.
  M3: vue-web-commons (#614) — framework-neutral only; package with dist/d.ts/peerDeps.
  M4: openapi-client-gradle + api-contract-checks (#615), agent-kit (#616), stalwart-provisioner (#617).
  M5: homelab-platform-blueprints (#618) — generic subset only; host data/secrets/jobs stay local.
  M6: design deploy-config-schema + authz-model (#619).

RULES (apply to every step):
  - Each new repo is created from ExtraToast/repo-template; operator applies the common ruleset so "Pipeline Complete" gates it.
  - One CI pipeline per repo, terminating in the single "Pipeline Complete" job — the only required check; add jobs by adding to its needs:.
  - Exact-pin all shared deps (no ^/~ ranges). Distribution: Maven dev.extratoast.* + npm @extratoast on GitHub Packages, images on ghcr.io/extratoast, reusable workflows via pinned uses: tags. PUBLISHING IS DONE BY RELEASE WORKFLOWS (their own GITHUB_TOKEN with packages:write), never by your token.
  - Respect platform differences and keep commons pluggable: Nomad+Consul vs k3s+Flux, Postgres/jOOQ vs MariaDB/JPA, PrimeVue+Tailwind vs Vuetify, pnpm vs Yarn Berry, Spring-Modulith-hexagonal+CommandBus vs DDD-layered. No jOOQ-only/PrimeVue-only types in core commons (use -jooq/-primevue add-on artifacts).
  - Do NOT extract: datastore/ORM, Nomad/Consul prod jobs, raw DNS zone contents, UI component systems (first release), RabbitMQ event constants, project-specific system-tests, OAuth clients/redirect URIs, concrete permission assignments.
  - Verify gradle changes by actually building (NOT in a codex sandbox — it cannot run gradle) or via CI.
  - git push over HTTPS with `gh auth token` embedded, then scrub the token from the remote URL. SSH remote is a read-only deploy key.
  - PRs: squash-only, linear history, impersonal voice, NO Co-Authored-By and NO "Claude" attribution anywhere (personal-stack CLAUDE.md), reference the tracking issue and "Part of #605", and update ISSUES.md in the same PR.
  - If you fan out with the council, it is configured all-Codex; never run it with claude:opus (it drains credits).