Axum geo bound from EdgeZero's manifest, so ctx.geo() needs no application boot profile #482

Summary

Axum geo bound from EdgeZero's manifest, so ctx.geo() needs no application boot profile.

Behavior

ctx.geo() gives country and region. Fastly keeps its existing geo. Axum uses CloudFront geo from #439, bound from EdgeZero's manifest so an application reads ctx.geo() without its own boot profile (EZI-4a). Cloudflare reads its request metadata (EZI-4c). Spin, whose requests carry no geo, reads a trusted ingress header the platform sets or a KV- or API-backed provider (EZI-4s, as IABTechLab/trusted-server#1518 describes for WASM targets).

Acceptance criteria

• A US request on Cloudflare and on Spin reports country and region, and Axum's geo loads with no Trusted Server geo setting

Dependencies

Blocked by:

• PR Add pluggable native Geo providers and protected CloudFront ingress #439 Add pluggable native Geo providers and protected CloudFront ingress

Blocks:

• Integration-branch revision with ClientInfo, JA4 and Axum geo binding #491 Integration-branch revision with ClientInfo, JA4 and Axum geo binding (new in this plan)

Related

• Needed by Server-side identity on every adapter trusted-server#1558, server-side identity on every adapter. Planned in wave 3 (MVP: Fastly and Axum); priority P1, size S.
• Work in progress: Add pluggable native Geo providers and protected CloudFront ingress #439 Add pluggable native Geo providers and protected CloudFront ingress
• Requirement EZI-4 in the design.