Connect Cloudflare config store to ts config push output #1140

Context

ts config push --adapter cloudflare writes an app-config envelope to a Cloudflare KV binding, but Worker startup currently reads the nested TRUSTED_SERVER_CONFIG variable. crates/trusted-server-adapter-cloudflare/src/lib.rs captures that variable; app.rs parses its envelope. The local Cloudflare smoke script bridges the two manually by reading the pushed KV value and assigning the JSON wrapper to the Worker variable. Request-time config and KV handles now exist in platform.rs, so the older PR #1049 statement that the store is never wired applies to startup, not to all requests.

A successful push alone therefore does not establish that the deployed Worker will start with the pushed configuration. The current Cloudflare guide documents the manual bridge.

Desired outcome

An operator has one explicit, tested path from a validated ts config push output to the configuration used at Worker startup.

Scoped work

Choose one supported contract:

1. Load and validate the pushed envelope from the Cloudflare config store during startup; or
2. Provide a CLI export or equivalent documented handoff that produces the exact startup binding format from the pushed envelope.

Preserve current envelope validation and secret resolution. Update the smoke and deployment guide for the selected path. Do not treat a request-time config handle as proof that startup reads KV.

Done when

• A round-trip test or local smoke pushes an envelope, starts the Worker through the chosen bridge, and confirms it uses the pushed settings.
• Missing, malformed, and stale or conflicting startup inputs have defined outcomes with tests.
• The CLI and Cloudflare deployment guide describe the same supported handoff.
• The prior manual bridge is either removed or clearly documented as the supported contract.

Evidence

PR #1049 documentation finding; current crates/trusted-server-adapter-cloudflare/src/lib.rs, app.rs and platform.rs, scripts/smoke-cloudflare.sh, and docs/guide/cloudflare.md at 666953a0d.