Upgrade EdgeZero to the deploy-actions branch

[aram356]

Summary

Upgrades the six edgezero workspace dependencies from tag = "v0.0.4" to the feature/edgezero-deploy-actions branch and adapts Trusted Server to its API changes.

• Repoint edgezero-adapter-{axum,cloudflare,fastly,spin}, edgezero-cli, and edgezero-core at the branch; refresh Cargo.lock (rev 145f1699).
• Wire the new ts CLI subcommands surfaced by edgezero-cli — active-version, healthcheck, rollback — plus deploy --stage and a top-level --version flag, with argument-parsing coverage.
• Migrate TrustedServerAppConfig to the AppConfigMeta::secret_fields() method that replaces the removed SECRET_FIELDS associated constant.

Verification

All CI gates run locally against the branch and pass:

• cargo fmt --all -- --check — clean
• cargo clippy — fastly, axum, cloudflare native + wasm, spin native + wasm — clean
• Tests — core 1644, fastly 99, axum 32, cloudflare 32, spin 72, cli 29 — all pass
• integration parity — 13 pass
• JS build/test/format — 411 pass, prettier clean

⚠️ Draft — blocked on upstream

stackpop/edgezero#316 is not yet merged. The branch = dependency ref is a moving target and can't merge as-is; before this lands, re-pin the six deps to a tagged release (or rev) once #316 merges.

Out of scope

Adopting the new deploy GitHub Actions (deploy-fastly / healthcheck-fastly / rollback-fastly) in this repo's workflows is separate, unstarted work.

Closes #939

[aram356]

Status update — P0/P1 tracking

Head: `96dd1f72` (main merged in twice since the original commit; edgezero dep unchanged, no conflicts).

P0.2 — CI + output-line contract

• Local verification at head is green: fmt, clippy (fastly), core+fastly tests (1648+99), vitest (411). The earlier red checks were a systemic/environmental run on `96dd1f72` (every job failed, incl. JS/fmt that pass locally) — fresh reruns of all four workflows are in progress.
• Machine-readable output lines the deployer parses are verified end-to-end. All three are emitted by edgezero-cli at `log::info!` (Info→stdout), and `ts`'s `main.rs` calls `edgezero_cli::init_cli_logger()`, so they reach stdout rather than being swallowed:

  Line	Source (edgezero @ 145f1699)
  `version=`	`edgezero-cli/src/lib.rs:253`
  `pushed-key=`	`edgezero-cli/src/config.rs:386`
  `rolled-back-to=`	`edgezero-adapter-fastly/src/cli.rs:2807`

• Dispatcher/arg-parse tests for `active-version`, `healthcheck`, `rollback` are in `crates/trusted-server-cli/src/run.rs`.

P1.3 — edgezero library ↔ action lockstep (recorded pair)

The `ts` CLI is built from this repo's `Cargo.toml` (edgezero library rev), and the deployer separately pins `stackpop/edgezero/.github/actions/deploy-fastly@` (edgezero action ref). These MUST be the same edgezero commit so library and action can't diverge.

• Current pair: both = `stackpop/edgezero@145f1699` (branch `feature/edgezero-deploy-actions`).
• On merge: when edgezero Remove immutable cache headers from integrations #316 lands and is tagged, move BOTH the six `Cargo.toml` deps and the deployer's `deploy-fastly@` to that same tag/SHA in lockstep.

P0.1 — re-pin off the moving branch (blocker, still open)

edgezero #316 is not yet merged and no new tag exists. Cannot re-pin until it lands; PR stays draft until then.