[ChristianPavilonis]

Summary

• Preserve existing Fastly surrogate-key metadata when callers use managed outbound HTTP. Tags are mutually exclusive with bypass and do not set TTL/stale overrides or a wire header.
• Expose the provider's existing paired time and Pending's existing borrowed readiness path, without another transport, completion state, detached task or deadline policy.

Depends on #275. Production changes are separate commits 251974d4 and dc296073; publication head also enables ordinary CI for stacked bases and updates its exact trigger regression.

Changes

Crate / File	Change
Core outbound	Tagged default policy, borrowed getter, paired-time getter and non-consuming poll_ready. collect reuses its existing drive path; is_ready is unchanged.
Fastly outbound	Map the typed selection to the existing SDK set_surrogate_key operation.
Core/adapters tests	Real wakeup/borrow-drop/cache/owner tests; SDK metadata for Send/Begin/Batch; optimizer preflight, redirect/signing and portable no-op checks.
Outbound spec and guide	Document tags, loss of Copy and snapshot/ownership boundaries.
Ordinary CI	Cover non-main PR bases while retaining main-only push and existing deployment triggers.

Closes

Closes #459

Test plan

Production-source checks at exact dc296073, with clean before/after fingerprints:

• cargo test --workspace --all-targets, default parallel: 2711 passed, one existing generated-workspace test ignored.
• cargo clippy --workspace --all-targets --all-features -- -D warnings.
• cargo fmt --all -- --check.
• cargo check --workspace --all-targets --features "fastly cloudflare spin".
• Target-matched Fastly WASM execution: 325 library +37 contract +1 API cases, using the repository-audited repaired Viceroy0.21, not stock-hosted qualification. Target Clippy passes.
• Cloudflare unknown-unknown and Spin wasip2 all-target compilation; native adjacent serial suite705 passes.
• Publication-only changes: 35 CI tooling tests and actionlint with ShellCheck pass.
• Outbound docs/legacy contracts and changed-content privacy audit pass.
• Full demo workspace/docs build and hosted cache fill/purge acceptance are not claimed by these local results.

A separate adjacent all-feature parallel Axum sample failed the unchanged pending_chunked_forward timing bound at 205.459963 ms against 200 ms +5 ms. The default primary pass does not clear or establish the cause of that miss. No threshold or assertion changed.

Workers SDK cache-mode test code compiled for its real target but was not browser-executed. Fastly SDK object checks prove metadata mapping, not hosted purge, private-response caching or Image Optimizer acceptance. Tagged optimizer requests reject before I/O because that SDK path replaces custom cache metadata. Other adapters retain their existing platform-default/no-op behavior.

The application owns its timer-first cutoff: borrow readiness before expiry, stop driving when the timer wins, then use the existing non-driving snapshot/collection rules. This PR does not change that policy.

Checklist

• No Tokio/runtime/SDK/dependency/capability pin changes.
• No second transport or compatibility carrier.
• New behavior has scoped/public API and cross-target tests.
• No credentials, licensed data or customer material added.
• Existing origin freshness, signing, response-body ownership and cancellation remain authoritative.

Draft while fresh hosted checks and combined application acceptance run. No deployment or merge into main is part of this PR publication.

[aram356]

CREATOR: From the server-side identity plan (IABTechLab/trusted-server#1559, c7dc9de77): Validate tags (printable ASCII, non-empty) and make Cloudflare reject tags instead of silently using the default. Fix the red Cloudflare wasm clippy; the fix exists only in RC commit ebf622c2. It removes Copy from an #275 public type, so it lands before R1.

Part of #488