Add custom Kingfisher container built from sporked feature branches

- Dockerfile: deterministic build from pinned CONTAINER_APP_VERSION + FEATURES
- Merges named feature branches at specific SHAs for reproducibility
- Switch CronJob to custom image with --clone-url-base and --all-organizations
- Add kingfisher to service-versions.yaml (version tracks upstream main SHA)
- Document spork container builds in new how-to card
- Document spork workflow in CLAUDE.md
- Update kingfisher service docs for custom image

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argocd/manifests/kingfisher/pv-nfs.yaml

@@ -1,9 +1,5 @@
 # NFS PersistentVolume for Kingfisher secret scan reports
 # Reuses the same sifaka:/volume1/reports share as Prowler
-#
-# Requires: NFS rule on sifaka for the "reports" share:
-#   Hostname=ringtail, Privilege=Read/Write, Squash=No mapping
-# (indri already has a rule for Prowler; ringtail needs its own)
 apiVersion: v1
 kind: PersistentVolume
 metadata: