[jopemachine]

Part of the AppProxy worker Ingress work (epic BA-8433). Independent of the coordinator stack; #15893 (TraefikWorkerClient) builds on it and carries these commits until this merges. Replaces #15916, whose branch was recreated.

Resolves #15914 (BA-8643)

Summary

• AbstractKVStore.compare_and_replace_prefixes(replacements, *, guards) replaces the subtrees as atomic_replace_prefixes does, only when every guard key holds its given value at commit (None: the key is absent).
  • Returns True when the replacement landed and False when a guard failed, leaving the subtrees as they were.
  • AsyncEtcd runs it through _request(..., conditional=True) like the existing conditional writes.
  • AgentEtcdClientView forwards it with the agent's scope prefixes, as it does compare_and_put and compare_and_delete.
• atomic_replace_prefixes and the new method share _replacement_ops, which builds the deletes of stale keys and the puts of new ones.

Test plan

• pants check / pants test on tests/unit/common/test_etcd.py and tests/unit/agent/test_etcd.py
• tests/unit/common/test_etcd.py — the subtree is replaced while the guard holds, left alone when the guard moved, and a None guard holds for an absent key
• tests/unit/agent/test_etcd.py — through AgentEtcdClientView, the guard and the subtree resolve in the same agent scope: replaced while the guard holds, left alone when it moved

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused addition preserves existing replacement logic, follows conditional-write patterns, and has no identified blocking defects.

No open issues 🎉

What changed in this PR

Adds guarded subtree replacement to the shared AsyncEtcd client, enabling conditional configuration updates for the AppProxy Traefik ingress work.

Changes:

• Adds compare_and_replace_prefixes, which commits replacements only when every guard matches, with None checking key absence.
• Shares replacement-operation construction with atomic_replace_prefixes.
• Adds tests for matching, changed, and absent guards, plus a feature changelog entry.

File	Description
tests/​unit/​common/​test_etcd.py	Tests successful replacement and preservation when a guard fails.
src/​ai/​backend/​common/​etcd.py	Adds guarded transactions and extracts the shared replacement helper.
changes/​15988.feature.md	Documents the new guarded replacement method.

_{Review effort: Balanced}

[HyeockJinKim]

It seems like there are a few more etcd calls than usual, but let's put this task aside for now and address it in a follow-up issue.