feat: provision --local (umbrella PR)

[aram356]

Umbrella PR for the provision --local workstream.

Closes #288.

Source artifacts

• Spec: docs/superpowers/specs/2026-06-23-provision-local.md (signed off by external review)
• Plan: docs/superpowers/plans/2026-06-27-provision-local.md — 43 tasks across 9 sections, also signed off

Architecture

A new ProvisionMode::Local arm threads through Adapter::provision. Local mode:

• synthesises minimal per-adapter manifests on a clean clone via toml_edit::DocumentMut (CLI-owned bootstrap, before validation)
• merges per-store bindings + env labels on top
• writes adapter-specific env files (.edgezero/.env, .dev.vars, <spin_crate>/.env)
• never shells out to cloud CLIs

Dry-run stages a real fs::copy into a tempfile::TempDir and diffs the result back. Cloudflare/Fastly/Spin manifests become gitignored generated state; Axum's axum.toml stays tracked. Generated <app-cli> runs run_provision_typed::<C> to add #[secret]-field placeholders the bundled edgezero can't see.

Execution plan

This umbrella PR opens as draft and stays draft. Each plan section gets its own follow-up PR that merges into this branch; once Sections 1–9 are all green, this PR converts to ready-for-review and merges to main.

Section breakdown

Each section tracks one sub-issue:

• Section 1 — CLI surface, neutral types, trait method (Tasks 1–5) — Section 1 — CLI surface, neutral types, trait method (Tasks 1–5) #289
• Section 2 — Shared path safety (Tasks 6–7) — Section 2 — Shared path safety (Tasks 6–7) #290
• Section 3 — Local provision orchestration + dry-run staging (Tasks 8–13) — Section 3 — Local provision orchestration + dry-run staging (Tasks 8–13) #291
• Section 4 — ManifestAdapterDeployed schema + writeback (Tasks 14–16, 16b–16c) — Section 4 — ManifestAdapterDeployed schema + writeback (Tasks 14–16, 16b–16c) #292
• Section 5 — Per-adapter local writers (Tasks 17–28, 28b) — Section 5 — Per-adapter local writers (Tasks 17–28, 28b) #293
• Section 6 — Typed provision wiring (Tasks 29–31, 30b) — Section 6 — Typed provision wiring (Tasks 29–31, 30b) #294
• Section 7 — Scaffold + gitignore + run_serve (Tasks 32–35) — Section 7 — Scaffold + gitignore + run_serve (Tasks 32–35) #295
• Section 8 — Documentation + CI grep gate (Tasks 36–37) — Section 8 — Documentation + CI grep gate (Tasks 36–37) #296
• Section 9 — Per-adapter contract tests + final verification (Tasks 38–43) — Section 9 — Per-adapter contract tests + final verification (Tasks 38–43) #297

CI gates (from the plan's Global Constraints)

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin

Test plan

• All five CI gates pass on the merged branch
• All four smoke scripts (scripts/smoke_test_{config,kv,secrets,config_key_override}.sh) pass with warm-up
• Per-adapter contract tests cover the four provision_local_* cases + Spin's env-label alignment quartet (Section 9)
• Worktree is clean after smoke matrix (Task 43 step 4 — umbrella gate)