Reduce Fastly adapter per-request fixed cost: defer KV/geo work, cache settings/registry/template fingerprint

[dhruv8sh]

Description

Implements several items from the 2026-07-05 performance & architecture review, driven by perf-based profiling of the real request path rather than assumption. Partially closes #855.

What changed:

• Defer EC-finalize KV writes (new-visitor creation, consent-withdrawal tombstone) past response send instead of blocking on them.
• Dedupe geo lookup — was called twice per request, now once. (Closes the geo-dedup item in Per-request fixed cost: release profile, settings pipeline trim, build-time tsjs hashes #855.)
• Memoize js_module_ids_immediate/deferred per registry instance; thread the already-computed tsjs bundle hash through to the ETag instead of re-hashing. (Partially addresses the tsjs hashing item in Per-request fixed cost: release profile, settings pipeline trim, build-time tsjs hashes #855 — Per-request fixed cost: release profile, settings pipeline trim, build-time tsjs hashes #855's build-time-constant approach goes further and is still open.)
• Fast-path strip_cookies when nothing needs stripping.
• AppCache: caches compiled Settings/AuctionPlan/IntegrationRegistry/RouterService across requests on a warm Fastly instance, invalidated by a config-store content hash (immediate) plus a 60s TTL backstop (bounds secret-rotation staleness). Also caches template_fingerprint (was re-serializing the whole settings struct to JSON + SHA-256 on every eligible request).

Verified: full CI gate green (fmt, all 8 clippy targets, all adapter test suites, parity, EC lifecycle integration test). Locally under Viceroy: near-total CPU elimination on settings/registry-dominated routes when warm; ~1.3% cycle reduction on full page renders (measured via perf stat, not wall-clock — HTML rewrite/origin fetch/auction dominate total cost there).

Done-when:

• Confirm AppCache hit rate on a real Fastly service (staging or prod), not just Viceroy.
• Follow up on Per-request fixed cost: release profile, settings pipeline trim, build-time tsjs hashes #855's remaining items (build-time tsjs hash constants, release profile tuning, trusted-blob validation skip, signing-key caching) not covered here.