[ChristianPavilonis]

Summary

Add optional source and command validation hooks for typed config validate, diff, and push. Existing entry points delegate to no-op hooks and retain their argument types and manifest/adapter validation scopes.

• Read app-config source exactly once and retain its bytes in the command context.
• Run the application source hook before environment overlay and typed deserialization.
• Share one overlay-applied value across structural checks, secret-reference checks, command validation, diff, and envelope serialization.
• Expose resolved command, target selection, app environment prefix, --no-env, and existing strict-validation metadata without adding fields to public argument types.
• Add a source-string parser to core so callbacks and typed loading never need filesystem snapshots or a second source read.

This is the narrow dependency prerequisite for IABTechLab/trusted-server#1194. It is based on v0.0.11, which already contains environment-scoped store selection.

Compatibility

No new provider operations, deployment behavior, storage format, secret-resolution behavior, or runtime dependencies. Source bytes and secret references have no derived Debug implementation and must not be logged by callbacks. Existing typed APIs use the same implementation with no-op hooks.

The tests replace the source after its first read and prove validate/diff/push continue using the original bytes and effective value. Additional cases cover explicit source paths, environment overlay, source rejection before invalid overlay, and command rejection before publication. Existing environment-sensitive push fixtures now share the existing manifest guard; parallel testing exposed previously unguarded reads of transient selector overrides.

Verification

• Six focused hook regression tests, including red/green reproduction of missing APIs.
• Final cargo test --locked -p edgezero-cli --lib: 229 passed.
• cargo test --locked --workspace --all-targets: passed before the final test-only additions; final CLI tests were rerun afterward.
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings: passed; final core/CLI all-target/all-feature lint rerun passed.
• cargo check --locked --workspace --all-targets --features "fastly cloudflare spin": passed.
• cargo check --locked -p edgezero-adapter-spin --target wasm32-wasip2 --features spin: passed.
• Formatting and git diff --check: passed.

Closes #470