Drain after-response tasks on SIGTERM #1575

Summary

Drain after-response tasks on SIGTERM.

Part of #1558, server-side identity on every adapter. Plan ID A3, planned in wave 5 (MVP: Fastly and Axum); priority P1, size S. Design: spec; order and dependencies: plan.

Requirements

AX-1 Production serving

The service binds a configured address, exits non-zero before listening when config, secrets or a required store fails to load, and on SIGTERM stops accepting, finishes in-flight requests and after-response tasks, and exits within a configured grace shorter than the ECS stop timeout.

ID-5 After-response work

Only pull sync and guarded follow-up writes run after the response is sent: after send on Fastly, a task drained on SIGTERM on Axum, waitUntil on Cloudflare. On Spin the work runs before the response (DEC-14; DEC-16 rules out skipping it).

Current state

What the code does today, from the design's survey at the revisions it names:

• AX-1: the RC line has startup, SIGTERM and connection drain, and scripts/test-native-ec-image.mjs from Extract native EC lifecycle and DynamoDB persistence #1536 passes locally but not in CI. Draining after-response tasks needs EZI-1; Add Axum production startup and bounded shutdown edgezero#406 drains connections only.

Acceptance criteria

• AX-1: An ECS-style stop during a request with a pending record write completes the request and the write, and CI runs that test
• AX-1: Startup with a missing secret exits non-zero before the port opens
• ID-5: On Fastly, Axum and Cloudflare a follow-up write recorded after send is in the record before the next navigation, and on Axum SIGTERM waits for it (A3). On Spin the follow-up write lands before the response

Dependencies

Blocked by:

• Integration-branch tag with the Fastly and Axum parts of EZI-1 edgezero#490 Integration-branch tag with the Fastly and Axum parts of EZI-1 (new in this plan)
• Serve Axum in production mode from main #1573 Serve Axum in production mode from main (new in this plan)