Align Fastly staging store selectors with EdgeZero PR 381

[aram356]

Summary

• Restore Fastly staging secret resolution by consuming the canonical store-selector behavior from EdgeZero PR 381.
• Use the canonical EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME selector in local and integration Viceroy configuration.
• Update operator guidance so production and staging select physical stores through their deployment environments.

The EdgeZero dependencies temporarily follow fix/fastly-environment-store-selectors and currently lock to 8efad3c80ce3eb10bef9e348dd316ff2c90e0fbf. Replace the branch dependency with the release tag after the upstream PR merges.

Changes

File	Change
Cargo.toml, Cargo.lock	Select and lock the EdgeZero PR 381 branch for every EdgeZero crate.
fastly.toml, Viceroy integration fixture	Replace the service-scoped secret-store mapping with the canonical selector.
Integration config test	Verify both Viceroy configurations map the canonical selector to ts_secrets.
Fastly and CLI guides	Document deploy-time environment selectors and staging store behavior.
Design and implementation plan	Record the root cause, selected approach, validation, and release-tag follow-up.

Closes

Closes #1174

Test plan

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare && cargo test-spin
• cargo clippy-fastly && cargo clippy-axum
• cargo clippy-cloudflare && cargo clippy-cloudflare-wasm
• cargo clippy-spin-native && cargo clippy-spin-wasm
• cargo check-fastly && cargo check-axum && cargo check-cloudflare && cargo check-spin
• cargo fmt --all -- --check
• ./scripts/test-cli.sh
• cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test integration local_fastly_secret_store_mapping_is_canonical --target aarch64-apple-darwin
• cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity --target aarch64-apple-darwin
• JS build: cd crates/trusted-server-js/lib && npm run build
• JS tests: cd crates/trusted-server-js/lib && npm test
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM release build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() added in production code
• No production logging changes
• New behavior has a regression test
• No secrets or credentials committed