Per-request fixed cost: release profile, settings pipeline trim, build-time tsjs hashes

[aram356]

Description

From the 2026-07-05 performance & architecture review (wasm/per-request fixed-cost section + client item 6).

Three independent "small each" wins on per-request fixed cost and deploy size:

1. Tune the release profile. The shipped artifact is 53.5 MiB of which ~45.6 MiB is DWARF (measured); code section is 5.3 MiB. Add lto = "thin", codegen-units = 1, strip debuginfo from the shipped artifact, add wasm-opt to the Fastly build. Expected 15-30% code-size cut plus cross-crate inlining gains (the per-request init below is all cross-crate).
2. Trim the per-request settings pipeline. The full pipeline runs per request: config-store chunk reads each SHA-256'd, envelope hash, JSON parse, validator walk, and compilation of every handler regex — all re-validating a blob the CLI already validated at push time. Ship a "trusted blob" version flag that skips runtime validation, drop per-chunk hashing (envelope hash covers it), and dedupe the double-loads (JA4 probe path, snapshot fallbacks, PartnerRegistry built twice, geo looked up twice). Also cache the parsed Ed25519 signing key per instance.
3. Build-time tsjs hashes. Bundles carry a full content hash in the URL but serve with max-age=300, and the guest re-concatenates and re-hashes ~350 KB per HTML page view to build the URL. Serve ?v=-matching requests with immutable, max-age=31536000, and compute all hashes in build.rs as constants.

Effort / expected effect

• Effort: Small each
• Expected effect: Per-request fixed cost and deploy size.

Sequencing item 9 of 10.