Add Axum production startup and bounded shutdown

[ChristianPavilonis]

Summary

• Add explicit production startup so required settings, stores, transport, and app-owned initialization succeed before accepting traffic. Keep permissive development entrypoints.
• Extend the existing native HTTP/1 runner with SIGINT/Unix SIGTERM handling, tracked graceful draining, a finite shutdown budget, and forced non-success exit.
• Add portable app-owned probes, shared typed startup config loading, retained handler state, and subprocess acceptance tests.

This PR is stacked on #275, with base branch docs/outbound-http-spec. The implementation started at 5527b58. It remains draft because #275 has advanced to 91f4af38, five parent-only commits beyond the common base 5527b58. Parent integration and re-audit, including the previously identified dev_server.rs conflict, remain outstanding. The recorded checks are for this branch, not integration with the current prerequisite. This relationship audit performed no merge or rebase. Integrate the current contracts and repeat affected validation before marking ready.

Changes

Crate / File	Change
edgezero-adapter-axum/src/dev_server.rs, run_options.rs	Explicit production and embedding APIs, prepared registries, app initializer, lifecycle ownership, signals, and bounded drain
Axum connection/service modules	Private dispatch gate, live lifecycle reader, and graceful HTTP/1 connection shutdown
Axum config/KV stores	Strict required config snapshots, explicit roots, same-name KV aliases, and redacted startup failures without delete-and-restart advice
edgezero-core/src/app.rs, router.rs	Startup-only typed state insertion with copy-on-write isolation and old-admission invalidation
edgezero-core/src/extractor.rs, probe.rs	Context-free typed config loading shared with request extraction, plus ordinary readiness/liveness actions
Native and portable test fixtures	Real process signals, finite/forced drain, startup failure/redaction, embedding, restart persistence, aliasing, stopped-writer backup/restore, and projected read-only config
Production hosting design	Contracts, acceptance boundaries, executed checks, and remaining integration/deployment work

Closes

Closes #392.
Closes #396.

Part of #391. This PR remains draft until the pending integration and acceptance work below is complete.

Remaining acceptance includes production adoption/storage guides, standalone release and Docker UID evidence, unreadable/unusable mount cases, retained-handle lock evidence, and the accepted-#275 re-audit.

Test plan

• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• Full WASM adapter builds for Fastly, Spin, and Cloudflare
• examples/app-demo workspace: cd examples/app-demo && cargo test --workspace --all-targets
• Docs build: cd docs && npm run lint && npm run format && npm run build
• Manual testing via edgezero serve --adapter axum
• cargo test -p edgezero-core --all-targets
• cargo test -p edgezero-adapter-axum --all-targets --all-features, including all 13 production-hosting subprocess tests
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin
• cargo check -p edgezero-core --test production_handlers --target <target> for wasm32-wasip1, wasm32-wasip2, and wasm32-unknown-unknown
• git diff --check

Checks passed on this branch, not on a merge with the newer prerequisite. Native subprocess tests use debug fixtures and the current user's UID, not a release container image. Shutdown cancellation is cooperative; blocking application code still requires a supervisor hard-kill boundary.

Checklist

• Changes follow CLAUDE.md conventions
• No Tokio deps added to core or adapter crates
• Route params use {id} syntax, not :id
• Types imported from edgezero_core, not http
• Store wiring goes through KvRegistry / ConfigRegistry / SecretRegistry
• New code has tests
• No secrets or credentials committed