Honor EdgeZero app config store default

[ChristianPavilonis]

Summary

• Derive the Trusted Server runtime app-config store ID and blob key from [stores.config].default in edgezero.toml at build time.
• Preserve trusted_server_config as the current default while retaining EdgeZero store name/key environment overrides.
• Align Fastly, Axum, Cloudflare, integration fixtures, and operator documentation with the manifest-defined default.

Changes

File	Change
crates/trusted-server-core/build.rs	Validate edgezero.toml and expose its default config-store ID as a compile-time value.
crates/trusted-server-core/src/config_payload.rs, settings_data.rs	Use the manifest-derived ID for the default runtime store and blob key, with regression coverage for manifest alignment and environment overrides.
crates/trusted-server-adapter-fastly/src/main.rs	Open the resolved manifest-default config store instead of a separate hardcoded name.
crates/trusted-server-adapter-cloudflare/	Read the manifest-default blob key while retaining compatibility with the legacy app_config key.
Integration fixtures and docs/guide/configuration.md	Generate and document app-config stores and keys from the shared manifest-derived constant.

Closes

Closes #866

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare; cargo clippy-cloudflare && cargo clippy-cloudflare-wasm; integration config generator and non-ignored integration tests; Spin, CLI, and parity tests

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!) — no runtime logging added; build-script println! calls emit required Cargo directives
• New code has tests
• No secrets or credentials committed