[ChristianPavilonis]

Summary

• Adapt TS main 6ef07ae52bec3e695ec57fe090243b1a281c314f to the exact EdgeZero AWS demo RC, 61bfe3b931fd97f5300287e4a91e33f32aa0fbee. All six workspace declarations use https://github.com/IABTechLab/edgezero.git.
• Make native startup require verified prepared configuration/secrets before listening. Keep request metadata local and send native outbound HTTP through the RC client, clock, limits and cancellation contracts.
• Migrate the shared Body/context API and supported adapters, preserve Fastly delivery ownership, and provide a tested local native image plus reproducible fixtures and operator guidance.

This is a temporary integration/demo candidate, not production certification.

The diff spans adapters because the pinned RC changes their shared request/body APIs. Spin also requires its SDK7 wasip2/P3 migration. Much of the added code is acceptance fixtures, lifecycle tests and validation documentation, not a broader feature rollout.

Changes

File	Change
Cargo.toml, Cargo.lock, rust-toolchain.toml, .tool-versions	Freeze the RC source and align Rust, SDK identities and local tools; retain the dependency-only ESI compatibility patch at 75bfbb396d4cb7792610f1287cbec61675f13f38.
crates/trusted-server-core/src/platform/http.rs and affected core handlers	Migrate exhaustive Body handling, preserve request heads and apply bounded body reads without changing core rewriting/auction/consent logic.
crates/trusted-server-adapter-axum/src/{startup,app,middleware,outbound,main}.rs	Build immutable prepared snapshots before listen, check ingress metadata and replace the bespoke outbound path with RC transport ownership.
crates/trusted-server-adapter-fastly/src/	Use closed RC transmission and run post-send work only after observed Completed Application egress; preserve named raw SDK probe exceptions.
crates/trusted-server-adapter-cloudflare/src/	Handle lazy uploads at the bounded SDK conversion boundary and install the missing console log backend.
crates/trusted-server-adapter-spin/src/	Await invocation-local SDK7 startup/snapshots and preserve encoded variable names and signing/JWKS inputs.
edgezero.toml and metadata tests	Remove the unused required generic KV declaration; dedicated Fastly EC storage is unchanged.
Adapter tests, scripts/smoke-*.sh, scripts/test-native-*.mjs, scripts/tests/, integration parity tests	Add real startup/HTTP/provider/image checks and lazy GET/POST/cookie regressions, with bounded cleanup and synthetic inputs.
Dockerfile, .dockerignore, .github/workflows/	Build a locked minimal non-root native image, exclude host/private/generated inputs, and add local build/smoke CI without publication.
docs/guide/native-rc-demo.md, docs/guide/native-rc-validation.md, AGENTS.md	Document operator inputs, exact tools, executed evidence, resolved failures and unverified work.

Refs

Refs #1236 and #1123. This does not close the broader production-support epic or adopt #1123's old EdgeZero tag.

Refs IABTechLab/edgezero#431.

Spec

Scoped compatibility design and two independent design-review rounds.