Scaffold hardened Axum application Docker recipes

[ChristianPavilonis]

Summary

• Generate an Axum application Dockerfile and .dockerignore at the workspace root, using the existing normalized package/binary names and shared Rust pin.
• Build only the locked native binary in a digest-pinned GNU/Bookworm builder; run it with CA trust, measured native libraries, numeric non-root identity, exec startup and explicit container binding.
• Document manual portable-dependency/lockfile preparation and add an opt-in disposable container smoke. No revision flag, dependency resolver changes, runtime changes or image publication.

Changes

Crate / File	Change
edgezero-cli/src/generator.rs, scaffold.rs	Conditional Axum root rendering, shared Rust pin, render and executed shell-toolchain tests
Root Dockerfile.hbs, dockerignore.hbs, README.md.hbs	Multi-stage recipe, context exclusions and ordinary application preparation/build/run instructions
scripts/test_generated_axum_container.sh	Actual context and final-filesystem inspection, ELF/runtime libraries, non-root/read-only/capability/mount checks, published HTTP and controlled positive/negative TLS
docs/guide/adapters/axum.md	Replace stale Rust 1.75 example; describe optional asset stages and packaging/runtime boundaries

Closes

Closes #398.

Implements the initial packaging slice A. This PR remains draft; its closing link does not establish completion of the remaining slice B acceptance. Required-config failure, durable restart, readiness and bounded SIGTERM acceptance remain for accepted PR #275 integration and #392/#396. #399 owns native amd64/arm64 CI and downstream publishing guidance; #400 owns deployment guidance.

Test plan

• cargo test -p edgezero-cli: 206 unit tests plus external-consumer test passed. The new container-render test failed before implementation and passed afterward.
• cargo test -p edgezero-adapter-axum --all-targets --all-features: 149 tests passed.
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin
• cargo test -p edgezero-cli --test generated_project_builds -- --ignored: host, typed CLI and all three installed WASM targets passed, none skipped.
• cargo test --locked --manifest-path examples/app-demo/Cargo.toml --workspace --all-targets
• Docs npm ci, npm run lint, npm run format, npm run build
• bash -n and ShellCheck 0.11.0 on the new smoke script
• Actual CLI generation without Axum linked emits no Dockerfile/.dockerignore.
• Standalone generated consumer manually prepared with public Git dependencies at audited main 98930917d96cb665c7255f36ca8bbd61fc7539e1, its own committed Cargo.lock and no out-of-context local dependencies. The unchanged generated Dockerfile built and passed the smoke on native Linux amd64.
• Controlled TLS success with OS roots plus disposable CA; rejection without that CA and with a wrong hostname. Root HTTP still succeeds in each case. Native ELF dependencies resolve to libgcc_s, libm, libc and the GNU loader.
• Tiny app-owned Node 24.12.0 stage with npm ci and a fresh asset build before Rust; Rust embeds generated bytes, the same smoke passes and the final image contains no Node/npm.

Container checks used Docker 29.7.2 on Linux amd64, Rust 1.95.0, and base digests embedded in the template. These are packaging checks, not an arm64, production-runtime, publishing, or Trusted Server application-image certification. No images were published. Full Trusted Server asset/config/bind integration remains downstream.

Checklist

• Changes follow CLAUDE.md conventions
• No Tokio or other runtime dependencies added
• No routing, portable HTTP contracts or store wiring changed
• New code has tests; Docker/network checks remain opt-in
• No secrets or credentials committed; TLS fixtures use disposable keys outside the app context and remove them during cleanup
• No new CLI revision/dependency-source feature or changes to NewArgs