feat: provision --local (umbrella PR)

.github/workflows/test.yml

@@ -58,6 +58,20 @@ jobs:
       - name: Nested AppConfig audit
         run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
 
+      # Enforce spec §"Cloudflare / Fastly / Spin manifests are gitignored"
+      # + §"Migration for downstream projects". The four generated adapter
+      # manifests (`wrangler.toml`, `fastly.toml`, `spin.toml`,
+      # `runtime-config.toml`) and Cloudflare's `.dev.vars` MUST NOT be
+      # tracked -- teammates regenerate them locally via
+      # `provision --local`. `axum.toml` is intentionally exempt:
+      # Axum owns its manifest and it stays tracked.
+      - name: Enforce Cloudflare/Fastly/Spin manifests and .dev.vars are not tracked
+        run: |
+          if git ls-files | grep -E '(^|/)(fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.dev\.vars$'; then
+            echo "::error::These adapter manifests AND Cloudflare's .dev.vars must be gitignored (spec §'Cloudflare / Fastly / Spin manifests are gitignored' + §'Migration for downstream projects'). axum.toml is the only adapter manifest that stays tracked. .dev.vars carries operator secret values and must NEVER be committed."
+            exit 1
+          fi
+
       - name: Run workspace tests
         run: cargo test --workspace --all-targets
 

.gitignore

@@ -14,7 +14,23 @@ target/
 .spin/
 .edgezero/
 
-# env
+# Cloudflare / Fastly / Spin adapter manifests -- regenerated by
+# `edgezero provision --local` (Tasks 17-28). Teammates must not
+# commit each other's per-machine ids (namespace ids, platform
+# binding names, etc.). axum.toml is INTENTIONALLY NOT in this
+# list -- Axum owns its manifest and it stays tracked.
+fastly.toml
+spin.toml
+wrangler.toml
+runtime-config.toml
+
+# Cloudflare per-adapter local secret placeholders -- written by
+# `<app-cli> provision --adapter cloudflare --local` (Task 20).
+# Operator-edited values must NEVER be committed.
+.dev.vars
+
+# env -- `.env` is provision-owned for Spin (Task 25) and Axum
+# (Task 27) too. Operator overrides live here.
 .env
 
 # OS