Extract prepared-store native startup and AWS providers #1524

Extract the existing native demo startup using bounded verified prepared configuration and secret snapshots before listening, with default-off AppConfig Agent and Secrets Manager provider forwarding. Preserve checked request-local ingress, trace/header sanitation, SDK-owned HTTP and delivery, immutable running snapshots and fail-before-listen behavior.

Retain real local startup/HTTP regressions and the existing reviewed native contract. This unit does not add native EC storage, Geo, images, Terraform, live AWS deployment or production qualification. Related original integration: #1424. Refs #1236 without closing that broader production-support work.