Load runtime config from config store

[ChristianPavilonis]

Summary

• Load Trusted Server application config at runtime from Fastly Config Store ts_config_store key ts-config instead of baking TOML into the binary.
• Add strict runtime config parsing, validation, canonical TOML generation, and config hashing.
• Update local Fastly/Viceroy development docs and scripts to render runtime config into a local config store.

Changes

File	Change
crates/trusted-server-adapter-fastly/src/main.rs	Loads and validates runtime config from Config Store before routing requests; logs config hash and preserves security warnings.
crates/trusted-server-core/src/runtime_config.rs	Adds runtime config loading, declared-field canonicalization, and SHA-256 hashing with tests.
crates/trusted-server-core/src/settings.rs	Rejects unknown config fields, exposes known top-level keys, and moves env-override config loading to test-only compatibility.
crates/trusted-server-core/build.rs / src/settings_data.rs	Removes build-time config baking.
crates/trusted-server-core/src/bin/ts-config-canonicalize.rs	Adds CLI helper to canonicalize config and print the config hash.
scripts/fastly-dev.sh / scripts/render-fastly-local-config.py	Adds local dev workflow for injecting canonical app config into fastly.local.toml.
trusted-server.example.toml	Renames sample config from the runtime config filename.
crates/integration-tests/**	Updates integration test setup and fixtures for runtime config-store loading.
docs/guide/** / docs/superpowers/specs/2026-04-20-config-store-runtime-config-design.md	Documents runtime config-store behavior, local testing, and error modes.

Closes

No issue provided.

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Not run locally; PR creation requested only.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses logging macros (not println!)
• New code has tests
• No secrets or credentials committed