Epic: provision --local implementation

[aram356]

Epic tracking the provision --local workstream.

Source artifacts

• Spec: docs/superpowers/specs/2026-06-23-provision-local.md
• Plan: docs/superpowers/plans/2026-06-27-provision-local.md
• Umbrella PR: feat: provision --local (umbrella PR) #287

Goal

Add --local to edgezero provision. Local mode synthesises minimal per-adapter manifests, merges per-store bindings, writes adapter-local env files, and never shells out to cloud CLIs. Dry-run stages a real tempdir copy and diffs the result back. Cloudflare/Fastly/Spin manifests become gitignored generated state; Axum's axum.toml stays tracked.

Sub-issues (one per plan Section)

• Section 1 — CLI surface, neutral types, trait method (Tasks 1–5) #289 — Section 1: CLI surface, neutral types, trait method (Tasks 1–5)
• Section 2 — Shared path safety (Tasks 6–7) #290 — Section 2: Shared path safety (Tasks 6–7)
• Section 3 — Local provision orchestration + dry-run staging (Tasks 8–13) #291 — Section 3: Local provision orchestration + dry-run staging (Tasks 8–13)
• Section 4 — ManifestAdapterDeployed schema + writeback (Tasks 14–16, 16b–16c) #292 — Section 4: ManifestAdapterDeployed schema + writeback (Tasks 14–16, 16b–16c)
• Section 5 — Per-adapter local writers (Tasks 17–28, 28b) #293 — Section 5: Per-adapter local writers (Tasks 17–28, 28b)
• Section 6 — Typed provision wiring (Tasks 29–31, 30b) #294 — Section 6: Typed provision wiring (Tasks 29–31, 30b)
• Section 7 — Scaffold + gitignore + run_serve (Tasks 32–35) #295 — Section 7: Scaffold + gitignore + run_serve (Tasks 32–35)
• Section 8 — Documentation + CI grep gate (Tasks 36–37) #296 — Section 8: Documentation + CI grep gate (Tasks 36–37)
• Section 9 — Per-adapter contract tests + final verification (Tasks 38–43) #297 — Section 9: Per-adapter contract tests + final verification (Tasks 38–43)

Dependency order

Section 1 ──┬──> Section 3 ──┬──> Section 5 ──> Section 6 ──┬──> Section 9
            │                │                              │
Section 2 ──┤                └──> Section 4 ─────────────────┘
            │                                                │
            └────────────────────────────────────────────────┴──> Section 7 ──> Section 8

Section 1 + Section 2 land first (independent). Section 3 depends on both. Section 4 can run in parallel with Section 3 once Section 1 lands. Section 5 needs 3 + 4. Section 6 needs 5. Section 7 needs 5/6 for the env files it loads. Section 8 needs 7. Section 9 is the umbrella gate.

CI gates (per plan's Global Constraints)

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin

Out of scope

Listed in the spec's "Out of scope" section — most notably: automatic Cloudflare preview-namespace capture, provision --local --gen-secrets, sync-deployed command, and OS-level filesystem sandboxing for adapter dispatch.