Make geolocation selectable with a no-location default #781

User story

As a deployer, I want to choose whether and how location is resolved, so that the default resolves no location and I opt into the host's geo explicitly.

Description

Select the geolocation source by configuration through the existing PlatformGeo interface. The default resolves no location, so the default path makes no host geo call. The host platform's own geo lookup is opt-in by configuration.

Done when

• The geo source is selected by [geo] module.
• The default resolves no location and makes no host geo call.
• The host platform geo is opt-in.
• A selected-but-unknown module is rejected at startup.

References

• Part of Pluggable, competition-neutral modules with a technical permission model #777. Implemented by device and geo module selection (Add device and geo module selection with the host-signal Edge Cookie module #1344), with the no-location default settled in the permission model (Add the permission model with the Privacy Taxonomy vocabulary #1345), where an unset [geo] module resolves no location and makes no host geo call.
• Related: Clean up dead GDPR country code in geo.rs and reconcile Eid/Uid types #518 (dead GDPR country code in geo.rs) and Thread RuntimeServices into downstream handlers #598 (RuntimeServices/geo threading).