Align Fastly staging store selectors with EdgeZero PR 381 #1174

Description

Fastly staging cannot build Trusted Server application state when the app config references secrets such as publisher.proxy_secret. The runtime falls back to the logical secret-store name trusted_server_secrets instead of opening the physical store selected by the staging GitHub Environment, such as ts_secrets.

The resulting startup error is:

failed to resolve secret reference at `publisher.proxy_secret` from secret store `trusted_server_secrets`

EdgeZero v0.0.8 uses service-scoped runtime selector keys. That model does not apply the canonical store selectors supplied by the selected deployment environment to each production or staging deployment. EdgeZero PR 381 replaces it: a managed deployment reads canonical EDGEZERO__STORES__<KIND>__<ID>__NAME selectors from the deployment environment and links each selected physical store to the target service version under its logical ID. The runtime opens stores by logical ID and reads the config entry under the logical ID for every target. The edgezero_runtime_env Config Store and the runtime selector lookup are removed.

Trusted Server should consume that upstream branch while PR 381 is under review and move its Fastly entry point, local Viceroy configuration, and documentation to the logical-ID model.

The expected staging selectors are:

EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME=<physical config store>
EDGEZERO__STORES__KV__TRUSTED_SERVER_KV__NAME=<physical kv store>
EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME=ts_secrets

Every logical store declared in edgezero.toml needs a selector or a same-named physical store, because the managed deploy resolves all of them before publishing.

Scope added during implementation

The trusted-server-js build script asked Cargo to rerun on every file under lib/, including node_modules, which emitted 33,932 rerun directives and invalidated the crate after any npm install. PR #1175 also narrows that to the bundle inputs.

Acceptance criteria

• All EdgeZero workspace dependencies use fix/fastly-environment-store-selectors until PR 381 is released.
• The Fastly entry point opens trusted_server_config and trusted_server_secrets by logical ID and no longer reads edgezero_runtime_env.
• Root and integration Viceroy configurations expose the secret store under trusted_server_secrets and define no edgezero_runtime_env store.
• A regression test verifies both Viceroy configurations expose the store under its logical ID.
• Fastly and CLI documentation describe deploy-time environment selection, logical-ID resource links, the fixed logical config key, and the application release that managed deploys require.
• The trusted-server-js build script watches only lib/src, the package manifests, and the bundler configuration.
• Target-matched build, test, lint, JavaScript, and documentation checks pass.
• A follow-up replaces the branch dependency with the release tag containing PR 381.