Build local product stack with Vault-managed secrets (#42)

AGENTS.md

@@ -22,6 +22,16 @@
   generated outputs. Document the generation workflow so a clean checkout can
   build without committed generated code.
 
+## Container versions
+
+Use only the latest stable upstream releases for infrastructure, product base
+images, build stages and disposable test containers. Exclude prereleases and
+vendor mainline channels when a separate stable channel exists. Resolve stable
+versions when building, pull fresh manifests, and pin the resolved image digests
+for that local build. Fail when stable release resolution fails; never silently
+fall back to an older cached version. Keep the reproducible resolver tracked and
+its generated local pins ignored by Git.
+
 ## Data and state architecture
 
 Preserve explicit **DTO → mapper → service → data model → provider → UI**