Harden deploy command contract and provider-manifest resolution

[prk-Jr]

Summary

• Reject ambiguous provider-manifest selection: when the workspace scan finds multiple fastly.toml / wrangler.toml / spin.toml equally near the working directory, fail with a candidate list instead of silently picking an order-dependent one — avoids deploying the wrong app from a multi-adapter/multi-app workspace.
• Fix the Cloudflare validation build to use the supported wrangler deploy --dry-run pipeline (the removed wrangler build command ran no real custom-build step).
• Document the build/deploy passthrough-argument contract and the manifest-resolution algorithm, including the no-secrets-in-passthrough guidance.

Changes

Crate / File	Change
edgezero-adapter/src/cli_support.rs	Add select_nearest_manifest: stable sort, unique-nearest selection, error on equidistant candidates; unit tests
edgezero-adapter-fastly/src/cli.rs	Route find_fastly_manifest through select_nearest_manifest; equidistant-rejection test
edgezero-adapter-cloudflare/src/cli.rs	Same resolution routing; change blueprint build to wrangler deploy --dry-run; scaffold + equidistant tests
edgezero-adapter-spin/src/cli.rs	Same resolution routing; equidistant-rejection test
docs/guide/cli-reference.md	Document passthrough-arg contract (build + deploy), no-secrets guidance, manifest-resolution algorithm
docs/guide/configuration.md	Update Cloudflare build example to wrangler deploy --dry-run
examples/app-demo/edgezero.toml	Update Cloudflare build command to wrangler deploy --dry-run

Test plan

• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo check --workspace --all-targets --features "fastly cloudflare spin"

Checklist

• Changes follow CLAUDE.md conventions
• No Tokio deps added to core or adapter crates
• Route params use {id} syntax (not :id)
• Types imported from edgezero_core (not http crate)
• New code has tests
• No secrets or credentials committed