Add EdgeZero-backed ts CLI

[ChristianPavilonis]

Summary

• Adds the host-target ts operator CLI crate and binary.
• Wires EdgeZero-backed lifecycle delegation and Trusted Server config init/validate/push flows.
• Moves runtime settings loading to flattened app-config entries and updates docs/CI for the host-target CLI.

Changes

File	Change
crates/trusted-server-cli/	Adds the base CLI crate, clap args, dispatch, EdgeZero delegate, config commands, and tests.
crates/trusted-server-core/src/config_payload.rs	Adds canonical flattened config payload generation and hash metadata.
crates/trusted-server-core/src/settings_data.rs	Loads settings from the platform config store instead of embedded build output.
crates/trusted-server-adapter-fastly/src/app.rs, src/main.rs	Reads settings through the Fastly config-store adapter.
.github/workflows/*, .cargo/config.toml	Adds host-target CLI check/test coverage and local aliases.
edgezero.toml, trusted-server.example.toml, .gitignore	Adds EdgeZero manifest/template config and ignores operator-owned config.
docs/guide/cli.md, docs/guide/getting-started.md, README.md	Documents base CLI install/config workflow.

Closes

No issue provided; this PR is split out from the combined feature/ts-cli-next branch.

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test --package trusted-server-cli --target aarch64-apple-darwin — 12 passed

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing/log macros (not println!)
• New code has tests
• No secrets or credentials committed