Add native celld config and KV store providers

[ChristianPavilonis]

Summary

• Add native celld configuration snapshots and live KV through a scoped API embedded inside celld, with independent default-off config/KV features.
• Preserve portable store traits and native startup ordering, with separate AWS/celld policies, credentials, accounting and actual-variant preparation sessions.
• Add bounded transport/fault tests, public-runner and generated-consumer proofs, structural-only CLI support, documentation and CI checks.

Changes

Crate / File	Change
edgezero-store-celld	Strict settings, redacted explicit tokens, bounded HTTP/TLS client, immutable config snapshots and live KV. No celld runtime or V8 dependency.
edgezero-adapter-axum	Per-ID typed bindings, once-only selected token capture, independent provider policies/capabilities and existing readiness/staging integration.
edgezero-cli and generated Axum manifest	Independent feature forwarding, structural-only validation with availability unknown, and selected remote config-push refusal.
Tests, scripts and CI	Feature-isolation checks, TLS/proxy/no-replay fault tests, mixed AWS/celld/local startup, generated consumers and explicit local-service acceptance.
Consumer lockfiles	Refresh settings-only provider edges for the excluded demo and reusable-app workspaces without registry version changes.
Documentation	Native celld guide, reviewed spec/plan and exact local verification evidence with remaining gaps.

Closes

No issue auto-closed. Related to #410 and stacked on #414. This is store-provider work, not the celld HTTP runtime adapter in #421.

Dependencies and draft status

• Base branch: issue-410-native-store-providers, currently draft Add native AWS store providers #414.
• Requires the unreleased embedded celld scoped API at f72ae21a515859570622ac9d6ca9c19cf6870b81. The companion celld branch remains local and has not been published by this PR.
• No gateway, sidecar, Worker bridge, celld secret provider or portable core trait changes.
• Fleet forwarding/reload/failover, production deployment isolation, replication/storage acceptance, upgrades and sustained fault/shutdown stress remain open. The generated TLS and disposable namespace-isolation proofs are separate arrangements.
• A real-service CI job remains deferred until a reviewed service artifact is available. Missing prerequisites fail the explicit local harness instead of passing by skipping.

Test plan

• cargo test --workspace --all-targets: 2,028 passed, 6 ignored. Ignored acceptance tests listed below were explicitly selected separately.
• cargo clippy --workspace --all-targets --all-features -- -D warnings, with focused Clippy follow-ups for the final test-only additions.
• cargo fmt --all -- --check and git diff --check.
• cargo check --workspace --all-targets --features "fastly cloudflare spin".
• All provider WASM target builds. Spin wasm32-wasip2 check passed; full Fastly and Cloudflare target builds were not executed.
• examples/app-demo full workspace tests. Both excluded consumer lockfiles passed offline locked metadata validation; reusable fixture-axum check passed.
• Docs lint, format and site build.
• Manual edgezero serve --adapter axum. Production-runner and generated native binaries were exercised instead.
• Provider settings/config/KV/combined suites: 4 / 27 / 30 / 38 passed, with independent feature Clippy checks.
• Native feature matrices, 253 combined native units, 4 celld startup subprocess tests, and 6 mixed/AWS startup tests. AWS-only startup also passed all 5 existing cases.
• Generated celld target with neither feature, each feature alone, both, and both alongside all AWS provider features.
• Real generated app against modified celld over verified TLS: binary/empty KV, pagination, 61-second expiry, immutable config adoption and persistence across app/celld restarts.
• Disposable user/network/mount/PID namespace proof for scoped access, internal-listener denial, hidden service files and server procfs isolation.
• Existing generated AWS and DynamoDB proofs, dependency feature-isolation checks, and 24 integration-runner Node tests.

All Cargo verification used offline locked dependencies after reviewed lockfile updates. The workspace test runner needed stdin closed because existing consent tests assume noninteractive CI. No test was excluded to resolve that run.

The real-service command requires an explicit modified binary and uses only disposable state and dummy credentials:

CELLD_BIN=/absolute/path/to/modified/celld \
EDGEZERO_GENERATED_TEST_TARGET_DIR=/absolute/path/to/disposable-build-cache \
node scripts/run_native_celld_integration.mjs

The implementation plan records the tested source/binary fingerprints and proof limits. No real AWS/fleet credentials or production deployment were used.

Checklist

• Changes follow CLAUDE.md conventions.
• No new direct Tokio dependencies in core or adapter crates; native transport lives in the provider crate.
• No legacy route-param syntax introduced.
• Application handlers use edgezero_core types.
• Store wiring uses the existing typed registries and staging path.
• New behavior has tests.
• No production secrets or credentials committed. The checked-in DER key/certificates and token strings are public, disposable fixture material only.