CLI Extensions — Stage 7: config push command #266

Part of the EdgeZero CLI Extensions effort — stage 7 of 8.

Scope: add the config push command — ConfigPushArgs (manifest, adapter, store, app_config, no_env, dry_run) and run_config_push (raw) + run_config_push_typed<C> (typed). Strict pre-flight validation; load app-config with env overlay (unless --no-env); flatten + serialize, skipping SECRET_FIELDS. Push split by adapter: axum writes .edgezero/local-config-<id>.json; cloudflare wrangler kv bulk put --namespace-id; fastly resolve store id via fastly config-store list then config-store-entry create; spin writes both spin.toml tables ([variables] + [component.<c>.variables]), .→__ lowercase keys. --dry-run prints, never mutates.

Ship gate: typed + raw; per-adapter golden payloads; secret fields absent; the "validate passes, push serialization fails" cases; the Spin spin.toml golden test (strongest-first validation ladder); --dry-run performs nothing.

Design spec: §13, §6.4, §6.5 — Implementation plan: Stage 7.