Create the protected integration branch and tag the #275 to #439 chain #488

Summary

Create the protected integration branch and tag #275 through #439.

Behavior

EdgeZero keeps a protected integration branch for this work (DEC-5), and each integration point is a tag on it that Trusted Server main pins until EdgeZero releases the work. R1 creates the branch and tags #275 through #439, so Axum production serving does not wait for the record contract. R1b adds EZI-2a and EZI-2b. R2 adds the Fastly and Axum parts of EZI-1. R2b adds EZI-3, #90, #92, the JA4 accessor (#283) and Axum's geo binding (EZI-4a), so providers never wait on JA4. Together R1, R1b, R2 and R2b cover Fastly and Axum. R3 adds the Cloudflare parts of EZI-1 to EZI-4, and R4 the Spin parts. EZI-2p and EZI-5 follow the MVP (DEC-15).

Acceptance criteria

• Each tag exists on the protected integration branch and Trusted Server main pins it
• R1, R1b, R2 and R2b contain no Cloudflare or Spin part

Dependencies

Blocked by:

• Axum: add safe production diagnostics and trusted-proxy handling #397 Axum: add safe production diagnostics and trusted-proxy handling
• Add native AWS configuration, secret, and ordinary KV store providers #410 Add native AWS configuration, secret, and ordinary KV store providers
• Add native celld configuration and KV store providers #437 Add native celld configuration and KV store providers
• Axum: add protected CloudFront Geo metadata provider #432 Axum: add protected CloudFront Geo metadata provider
• PR range feat: implement portable outbound HTTP and request lifecycle contracts #275 to Add pluggable native Geo providers and protected CloudFront ingress #439 (merge in the plan's Part A order)

Blocks:

• Serve Axum in production mode from main trusted-server#1573 Serve Axum in production mode from main (new in this plan)

Related

• Needed by Server-side identity on every adapter trusted-server#1558, server-side identity on every adapter. Planned in wave 3 (MVP: Fastly and Axum); priority P1, size S.
• Work in progress: feat: implement portable outbound HTTP and request lifecycle contracts #275 feat: implement portable outbound HTTP and request lifecycle contracts
• Work in progress: Preserve outbound cache tags and borrowed readiness #460 Preserve outbound cache tags and borrowed readiness
• Work in progress: Add configurable Axum buffered JSON body limits #407 Add configurable Axum buffered JSON body limits
• Work in progress: Add native AWS store providers #414 Add native AWS store providers
• Requirement EZI-6 in the design.