Add EdgeZero-backed Trusted Server CLI and audit bootstrap

[ChristianPavilonis]

Summary

• Adds a host-target ts product CLI backed by EdgeZero for auth/provision/serve/build/deploy and config push workflows.
• Adds deterministic Trusted Server config init/validate/push support with flattened config payloads and runtime reconstruction helpers.
• Adds ts audit to inspect public pages with headless Chrome/Chromium, write js-assets.toml, and bootstrap a draft trusted-server.toml.

Changes

File	Change
crates/trusted-server-cli/	New ts CLI crate with clap args, config commands, EdgeZero delegation, and audit command.
crates/trusted-server-core/src/config_payload.rs	Adds deterministic flatten/hash payload helpers for config-store entries.
crates/trusted-server-core/src/settings*.rs	Aligns runtime config loading with flattened config-store entries and stricter validation.
crates/trusted-server-adapter-fastly/src/main.rs	Loads runtime settings from platform config-store path.
edgezero.toml	Adds Trusted Server EdgeZero manifest.
trusted-server.example.toml / .gitignore	Moves source-controlled config to an example template and ignores operator-owned outputs.
docs/superpowers/specs/ and docs/superpowers/plans/	Adds design specs and implementation plans for the EdgeZero CLI and audit command.
docs/guide/cli.md, docs/guide/getting-started.md, README.md	Documents the new CLI and audit workflow.
.cargo/config.toml, CI workflows	Adds host-target CLI aliases/checks.

Closes

• Closes Port EdgeZero CLI to TS #770

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npx prettier --check .
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test --package trusted-server-cli --target "$(rustc -vV | sed -n 's/^host: //p')"
• Other: cargo clippy --package trusted-server-cli --target "$(rustc -vV | sed -n 's/^host: //p')" --all-targets -- -D warnings
• Other: cargo build --package trusted-server-cli --target "$(rustc -vV | sed -n 's/^host: //p')"
• Other: cargo run --package trusted-server-cli --target "$(rustc -vV | sed -n 's/^host: //p')" -- audit --help

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses project logging/output conventions (no println!/eprintln! in production CLI code)
• New code has tests
• No secrets or credentials committed