Run the SIGTERM-during-record-write test in CI (scripts/test-native-ec-image.mjs from #1536) #1579

Summary

Run the SIGTERM-during-record-write test in CI (scripts/test-native-ec-image.mjs from #1536).

Part of #1558, server-side identity on every adapter. Plan ID A8, planned in wave 8 (MVP: Fastly and Axum); priority P1, size S. Design: spec; order and dependencies: plan.

Requirements

AX-1 Production serving

The service binds a configured address, exits non-zero before listening when config, secrets or a required store fails to load, and on SIGTERM stops accepting, finishes in-flight requests and after-response tasks, and exits within a configured grace shorter than the ECS stop timeout.

Current state

What the code does today, from the design's survey at the revisions it names:

• AX-1: the RC line has startup, SIGTERM and connection drain, and scripts/test-native-ec-image.mjs from Extract native EC lifecycle and DynamoDB persistence #1536 passes locally but not in CI. Draining after-response tasks needs EZI-1; Add Axum production startup and bounded shutdown edgezero#406 drains connections only.

Acceptance criteria

• AX-1: An ECS-style stop during a request with a pending record write completes the request and the write, and CI runs that test
• AX-1: Startup with a missing secret exits non-zero before the port opens

Dependencies

Blocked by:

• Identity on Axum through T21's shared app #1574 Identity on Axum through T21's shared app (new in this plan)