refactor(consul-postgres-ha): consolidate to single polished template

The directory was an engineering log — phase0/, stage1/, stage2/,
stage3a/, stage3b/, stage4/, stage4-experiments/ — useful while
building, useless to a user landing here cold who just wants to
deploy HA Postgres on dstack-TEE.

Promote stage4/ contents up one level to consul-postgres-ha/ as the
canonical, opinionated shape. Rename phase0/icetest → signaling/.
Move stage3b/{webdemo,sidecar} up. Drop the predecessor stage*/ +
phase0/ + stage4-experiments/ + deploy/ (historical results) +
STAGE4_PLAN.md. Git history preserves everything.

Final layout:

  consul-postgres-ha/
  ├── README.md / ARCHITECTURE.md / FAILOVER.md / PUBLISHING.md / ROBUSTNESS.md
  ├── cluster-example/   one cluster.tf
  ├── compose/           coordinator.yaml + worker.yaml templates
  ├── coordinator/       external-coordinator docker-compose
  ├── mesh-conn/         QUIC-over-pion/ICE overlay
  ├── bootstrap-secrets/ TEE-derives per-CVM secrets
  ├── patroni/           Patroni + Postgres
  ├── webdemo/ sidecar/  example workload + Envoy bootstrapper
  ├── signaling/         HTTP /publish + /poll broker for ICE rendezvous
  └── quic-on-ice/       standalone smoke test for the QUIC-over-ICE transport

Updates beyond the moves:
- README.md rewritten as a deploy-first story; old stage-4-internal
  README's "Known limitation" + punch-list (yamux + worker-pair
  instability) is obsolete since the QUIC swap and isn't preserved.
- ARCHITECTURE.md: 4-CVM topology (ctrl+w1/w2/w3) → 6-CVM (3+3),
  yamux deep-dive section replaced with a tight QUIC summary that
  matches the actual code.
- ROBUSTNESS.md: yamux → QUIC mentions, "single Consul server SPOF"
  section updated to reflect the 3-server quorum that's been live
  since `17f4642`, "real registry" recommended-fix moved to "already
  shipped" since GHCR + Sigstore is now the publish path.
- All Go module paths bumped: github.com/Dstack-TEE/dstack-examples
  /consul-postgres-ha/<name> (no stage4/ or phase0/ infix).
- CI workflow path filters + matrix `context:` paths updated.
- .gitignore rewritten to match the new layout.
- Builds + tests pass on all 5 Go modules under the new paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

.github/workflows/consul-postgres-ha-publish.yml

@@ -1,8 +1,8 @@
 name: Publish consul-postgres-ha images
 
-# Builds and publishes the six container images that the stage-4
-# consul-postgres-ha example needs (mesh-conn, bootstrap-secrets,
-# signaling, webdemo, sidecar, patroni). On push to main, images are
+# Builds and publishes the six container images the consul-postgres-ha
+# example needs (mesh-conn, bootstrap-secrets, signaling, webdemo,
+# sidecar, patroni). On push to main, images are
 # tagged with the commit SHA *and* `latest`, pushed to GHCR, and
 # attested with Sigstore-backed GitHub Build Provenance so consumers
 # can verify "this image came from this commit of this repo" without
@@ -23,21 +23,21 @@ on:
   push:
     branches: [main]
     paths:
-      - 'consul-postgres-ha/stage4/mesh-conn/**'
-      - 'consul-postgres-ha/stage4/bootstrap-secrets/**'
-      - 'consul-postgres-ha/stage4/patroni/**'
-      - 'consul-postgres-ha/stage3b/webdemo/**'
-      - 'consul-postgres-ha/stage3b/sidecar/**'
-      - 'consul-postgres-ha/phase0/icetest/**'
+      - 'consul-postgres-ha/mesh-conn/**'
+      - 'consul-postgres-ha/bootstrap-secrets/**'
+      - 'consul-postgres-ha/patroni/**'
+      - 'consul-postgres-ha/webdemo/**'
+      - 'consul-postgres-ha/sidecar/**'
+      - 'consul-postgres-ha/signaling/**'
       - '.github/workflows/consul-postgres-ha-publish.yml'
   pull_request:
     paths:
-      - 'consul-postgres-ha/stage4/mesh-conn/**'
-      - 'consul-postgres-ha/stage4/bootstrap-secrets/**'
-      - 'consul-postgres-ha/stage4/patroni/**'
-      - 'consul-postgres-ha/stage3b/webdemo/**'
-      - 'consul-postgres-ha/stage3b/sidecar/**'
-      - 'consul-postgres-ha/phase0/icetest/**'
+      - 'consul-postgres-ha/mesh-conn/**'
+      - 'consul-postgres-ha/bootstrap-secrets/**'
+      - 'consul-postgres-ha/patroni/**'
+      - 'consul-postgres-ha/webdemo/**'
+      - 'consul-postgres-ha/sidecar/**'
+      - 'consul-postgres-ha/signaling/**'
       - '.github/workflows/consul-postgres-ha-publish.yml'
   workflow_dispatch:
 
@@ -60,17 +60,17 @@ jobs:
       matrix:
         include:
           - name: mesh-conn
-            context: consul-postgres-ha/stage4/mesh-conn
+            context: consul-postgres-ha/mesh-conn
           - name: bootstrap-secrets
-            context: consul-postgres-ha/stage4/bootstrap-secrets
+            context: consul-postgres-ha/bootstrap-secrets
           - name: patroni
-            context: consul-postgres-ha/stage4/patroni
+            context: consul-postgres-ha/patroni
           - name: signaling
-            context: consul-postgres-ha/phase0/icetest
+            context: consul-postgres-ha/signaling
           - name: webdemo
-            context: consul-postgres-ha/stage3b/webdemo
+            context: consul-postgres-ha/webdemo
           - name: sidecar
-            context: consul-postgres-ha/stage3b/sidecar
+            context: consul-postgres-ha/sidecar
 
     steps:
       - uses: actions/checkout@v4

.gitignore

@@ -1,22 +1,18 @@
 
 *~
 .claude/
-# compiled go binaries
+
+# consul-postgres-ha — compiled Go binaries (build artifacts)
 consul-postgres-ha/.local/
-consul-postgres-ha/phase0/icetest/icetest
-consul-postgres-ha/stage1/mesh-conn/mesh-conn
-consul-postgres-ha/stage3a/webdemo/webdemo
-consul-postgres-ha/stage3b/webdemo/webdemo
-consul-postgres-ha/stage4/bootstrap-secrets/bootstrap-secrets
-consul-postgres-ha/stage4/cluster-example/.terraform/
-consul-postgres-ha/stage4/cluster-example/.terraform.lock.hcl
-consul-postgres-ha/stage4/cluster-example/terraform.tfstate*
-consul-postgres-ha/stage4/cluster-example/terraform.tfvars
-consul-postgres-ha/stage4-experiments/**/.terraform/
-consul-postgres-ha/stage4-experiments/**/.terraform.lock.hcl
-consul-postgres-ha/stage4-experiments/**/terraform.tfstate
-consul-postgres-ha/stage4-experiments/**/terraform.tfstate.backup
-consul-postgres-ha/stage4-experiments/**/terraform.tfvars
-consul-postgres-ha/stage4/mesh-conn/mesh-conn
-consul-postgres-ha/stage4/quic-on-ice/quic-on-ice
-# terraform local state
+consul-postgres-ha/bootstrap-secrets/bootstrap-secrets
+consul-postgres-ha/mesh-conn/mesh-conn
+consul-postgres-ha/quic-on-ice/quic-on-ice
+consul-postgres-ha/signaling/signaling
+consul-postgres-ha/signaling/icetest
+consul-postgres-ha/webdemo/webdemo
+
+# consul-postgres-ha — local terraform state (per-deploy, not for git)
+consul-postgres-ha/cluster-example/.terraform/
+consul-postgres-ha/cluster-example/.terraform.lock.hcl
+consul-postgres-ha/cluster-example/terraform.tfstate*
+consul-postgres-ha/cluster-example/terraform.tfvars