Align Spin typed-secret validation with runtime variable encoding

[ChristianPavilonis]

Problem

The Spin CLI validates typed app-config secret values as lowercase ^[a-z][a-z0-9_]*$ names and lowercases before collision detection. That does not match the runtime contract used by downstream apps that encode a (store, key) into a Spin variable name.

For example, Trusted Server accepts lower-case-leading keys and encodes uppercase characters and -, _, ., and : with a v_ prefix plus hexadecimal escapes. The current EdgeZero validator rejects several keys the runtime supports, can accept/reject a different collision set, and rejects repeated references to the same physical secret even though they resolve unambiguously to one variable.

This makes config validate / config push disagree with deployed Spin behavior. It may also make a non-Spin target fail due to a declared Spin adapter's portability validation.

Proposed direction

• Define one canonical Spin secret-variable encoder for (store, key) and use it for both runtime lookup and CLI validation.
• Validate the encoded variable name rather than applying a separate lowercase-only rule to the raw secret key.
• Deduplicate identical physical references. Reject only when two distinct (store, key) pairs encode to the same variable name.
• Scope adapter-specific portability validation to the selected target adapter, or expose an explicit all-adapters portability mode.

Acceptance criteria

• Runtime lookup and CLI validation share one documented encoder/validation contract.
• Supported punctuation and uppercase escapes validate exactly when the runtime can resolve them.
• Identical repeated secret references validate successfully.
• Distinct references that truly collide after encoding fail with both source paths named.
• A Fastly/Axum/Cloudflare push is not blocked solely by Spin portability rules unless the caller explicitly asks for all-adapter validation.
• Add contract tests for encoding, duplicate references, real collisions, and target-adapter selection.

Downstream impact

Trusted Server currently pins EdgeZero at bb4411625856472b1279a3db49aeeac5e8b1507e. Once fixed, it should update that pin and add a regression test around its Spin secret references.