[Feature][AI] Add versioned prompt templates with validation, rollout and rollback #8051

Feature Request

The existing ai-prompt plugin decorates requests. Teams also need reviewable template versions and predictable rollout without changing every application.

Proposed scope

• Add immutable template versions with typed/bounded variables, explicit role/message semantics and validation before publication.
• Manage draft, publish, tenant-scoped rollout and rollback through Admin and existing configuration sync.
• Capture the effective template revision per request; include it in audit and AI cache identity.
• Preserve tool-call messages and protocol-specific structures; separate deterministic prompt decoration from transformers that invoke another model.

Acceptance criteria

• Template updates and rollback are consistent for newly admitted requests while in-flight requests retain their snapshot.
• Missing/invalid variables fail predictably and cannot inject unexpected roles or expose secrets.
• Tests cover message preservation, concurrent tenants, sync recovery and cache invalidation; examples show versioned rollout.

Dependencies and boundaries

Reuse ai-prompt and existing config lifecycle; #7959 owns MCP prompts aggregation and is a different feature. Coordinate #7950 and caching. No conversation memory or orchestration engine.

Additional context

Proposed priority: P1 (for discussion, not a maintainer commitment). Workspace evidence must be reconciled with merged master and open PR ownership before implementation.

References: Higress AI plugins, agentgateway documentation. These are design references, not claims of ShenYu feature parity.

Prompt Registry manifest and gated publication (2026-10-30)

The registry owns auditable, reproducible releases rather than only storing prompt text. Preserve ai-prompt defaults and reuse Admin -> configuration sync -> gateway cache; runtime gateways never query the Admin database.

A frozen publication version records at least:

prompt_id
prompt_version
owner
task_type
model_family
system_prompt
template_variables
tool_schema_version
retriever_version
index_version
safety_policy_version
eval_set_version
created_at
change_reason

Scope prompt identity to the authorized tenant/namespace. template_variables declares typed/bounded variables, not stored request values or secrets. Add a content digest and creation/publication actors. Tool, retriever, index, safety and eval versions are validated dependency references where applicable; this task does not own another RAG or evaluation platform. Represent unused/unknown references explicitly; strict reproducibility requires resolvable pinned dependencies, not invented revisions. Coordinate #8060 configuration consistency.

Keep immutable version manifests separate from mutable aliases/release/rollout state. Published versions cannot be edited in place. Each request captures its prompt/dependency snapshot and records the actual prompt_id / prompt_version; retries/fallback retain that prompt version and still validate model compatibility.

local prompt edit
  -> freeze and validate a candidate version
  -> pass offline evaluation thresholds
  -> authorized small-traffic canary
  -> observe quality, latency, cost and safety
  -> promote after the gate passes
  -> roll back to the previous compatible published version on regression

Require trusted evaluation evidence tied to the exact prompt digest, eval-set version and relevant model/configuration, with thresholds and results. Reuse operator-owned CI/evaluation runners; client-supplied passed=true is not a publication gate. #8256 owns sample/feedback export; #8052 owns routing-quality evaluation.

Stage 1: immutable versions, deterministic bounded rendering, explicit publish/rollback, effective-version request facts and a Chat/Responses/tool-message compatibility matrix. Stage 2: tenant-scoped deterministic canaries, evaluation evidence and guarded promotion. Define minimum/delayed evidence, authorization and cache identity. Test tenant isolation, sync/reconnect, rollback, in-flight streams and unavailable dependencies. Rollback selects a compatible historical manifest without mutating history or restoring revoked access; unsupported dependencies cannot silently resolve to current versions.