Guard local provisioning and config paths #290

Description

Section 2 of #288 covers shared path safety for local provisioning and config operations. PR #287 contains the proposed implementation but remains unmerged. Dependencies: none beyond the umbrella contract.

Steps to reproduce

Inspection steps (no tests executed):

1. Inspect main provision orchestration.
2. Compare this section’s tasks in local-provision plan with the open branch.
3. Confirm the local-provision contract is still absent from main rather than treating checked-off branch tasks as delivery.

Expected behavior

The section’s contract is present on main and composes with the other local-provision sections without cloud operations during local mode.

Impact

Operator-declared adapter paths need a consistent containment boundary before local writes or staged copies.

Proposed fix

Review and merge this section through PR #287, preserving the tasks below and subsequent umbrella amendments. Reconcile with current main rather than reintroducing removed Fastly runtime-env descriptors.

Dependencies: none beyond the umbrella contract.

Done when

• Task 6: Create path_safety module with assert_provision_paths_contained (relative-root short-circuit; manifest-inside-crate check; 8 unit tests)
• Task 7: Wire path_safety into config push --local's args.local arm; mirror tests beside config fixtures
• Include the original eight path-safety unit cases and two push-side mirror regressions; apply the umbrella’s later safe/contained distinction to config diff and serve as documented in feat: provision --local + gitignored adapter manifests + hardened path safety #287.

Required repository verification: cargo fmt --all -- --check; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo test --workspace --all-targets; cargo check --workspace --all-targets --features "fastly cloudflare spin"; cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin. These are acceptance requirements, not tests executed during this audit.

Related

#288; local-provision plan; PR #287 is the fully covering open PR. This section is a foundation for later sections.

July amendment: all five generated manifests, including axum.toml, are gitignored.