Serve Axum in production mode from main #1573

Summary

Serve Axum in production mode from main: rebase #1531 onto #1506 (#1528 closes), with startup, stores and client IP from EdgeZero; repin to R1.

Part of #1558, server-side identity on every adapter. Plan ID A1, planned in wave 4 (MVP: Fastly and Axum); priority P1, size L. Design: spec; order and dependencies: plan.

Requirements

AX-1 Production serving

The service binds a configured address, exits non-zero before listening when config, secrets or a required store fails to load, and on SIGTERM stops accepting, finishes in-flight requests and after-response tasks, and exits within a configured grace shorter than the ECS stop timeout.

AX-2 Managed config and secrets

Config and secrets load from AWS stores through EdgeZero store providers. Environment overrides use the full TRUSTED_SERVER__ prefix only.

AX-7 Ships from main

Main never pins an EdgeZero RC tag (IABTechLab/edgezero#431, IABTechLab/edgezero#462) or a revision that exists only on an RC branch, such as 456313675, which #1528 pins today. Main may pin IABTechLab/edgezero#275's head under DEC-1, or a tag on EdgeZero's protected integration branch under DEC-5, which carries only work headed for EdgeZero main.

Current state

What the code does today, from the design's survey at the revisions it names:

• AX-1: the RC line has startup, SIGTERM and connection drain, and scripts/test-native-ec-image.mjs from Extract native EC lifecycle and DynamoDB persistence #1536 passes locally but not in CI. Draining after-response tasks needs EZI-1; Add Axum production startup and bounded shutdown edgezero#406 drains connections only.
• AX-2: main reads TRUSTED_SERVER_CONFIG_* and TRUSTED_SERVER_SECRET_*, which Initialize native TS from prepared immutable stores #1528 removes; the RC adds TS_NATIVE_GEO_PROFILE_FILE, TS_NATIVE_BINDINGS_TOML and TS_APPCONFIG_TOKEN.

Acceptance criteria

• AX-1: An ECS-style stop during a request with a pending record write completes the request and the write, and CI runs that test
• AX-1: Startup with a missing secret exits non-zero before the port opens
• AX-2: An Axum startup test loads config and secrets through the providers in Add native AWS store providers edgezero#414, and no runtime code reads a TS_* or TRUSTED_SERVER_CONFIG_* / TRUSTED_SERVER_SECRET_* name
• AX-7: Cargo.lock on main resolves every EdgeZero crate to a released tag, feat: implement portable outbound HTTP and request lifecycle contracts edgezero#275's head or an integration-branch tag

Dependencies

Blocked by:

• Create the protected integration branch and tag the #275 to #439 chain edgezero#488 Create the protected integration branch and tag the Fix use of ensure_backend_from_url in datadome integration #275 to Bump derive_more from 2.0.1 to 2.1.1 #439 chain (new in this plan)
• Cut Trusted Server over to EdgeZero PR 275 #1507 Cut Trusted Server over to EdgeZero PR 275

Blocks:

• Identity on Axum through T21's shared app #1574 Identity on Axum through T21's shared app (new in this plan)
• Drain after-response tasks on SIGTERM #1575 Drain after-response tasks on SIGTERM (new in this plan)
• Build the production image from source (#1539, #1538) #1577 Build the production image from source (Separate the source-built native image #1539, Separate the native AWS runtime wrapper #1538) (new in this plan)
• Axum reference infrastructure #1578 Axum reference infrastructure (new in this plan)
• CI guard: runtime code reads only TRUSTED_SERVER__ environment names #1580 CI guard: runtime code reads only TRUSTED_SERVER__ environment names (new in this plan)
• Extract the protected CloudFront native Geo integration #1529 Extract the protected CloudFront native Geo integration
• Make Axum consume the local config store written by ts config push #1141 Make Axum consume the local config store written by ts config push

Related pull requests

• Extract native prepared startup on the demo baseline #1531 Extract native prepared startup on the demo baseline: carries part of this work.

  Fixes the plan asks of Extract native prepared startup on the demo baseline #1531

  It now targets Cut Trusted Server over to EdgeZero PR 275 #1506's branch but forks from main with its own cutover rebuild (82d7e3be8) and the RC tag pin, so 15 files conflict with Cut Trusted Server over to EdgeZero PR 275 #1506 at 9ec4711d3. Rebase onto Cut Trusted Server over to EdgeZero PR 275 #1506's head, drop that rebuild and the pin, and repin to R1 (DEC-5). Startup, stores and the client IP come from EdgeZero (Add Axum production startup and bounded shutdown edgezero#406, Add native AWS store providers edgezero#414, feat(axum): add safe diagnostics and trusted proxy metadata edgezero#409). Carry Initialize native TS from prepared immutable stores #1528's open items where they apply: the CLI test (AxumDevServerConfig lacks ingress), the type error, the CodeQL alerts and the per-request AtomicBool in the Fastly AppState.

Notes from the plan

• A1 replaces the local configuration bridge:
• Cut Trusted Server over to EdgeZero PR 275 #1507 delivers the cutover and stays under Integrate Auctioneer into Trusted Server on EdgeZero PR 275 #1505; it blocks A1, T4, T5, T21, Reduce Fastly adapter per-request fixed cost: defer KV/geo work, cache settings/registry/template fingerprint #1192 and Certificate checks on identity backends that still follow proxy.certificate_check #1556.