MANUAL RUN: switch on borg-edge (environment, Cloudflare secrets, BORG_EDGE=1) #878

Follow-up to #866 / #877. Agents can't add secrets or environments, so this one is the owner's. #865 (the Free-plan deploy and its edge grid) is folded in here: the first borg-edge run deploys slim borg, writes the grid to the job summary and destroys it, so it covers #865 in the same sitting.

1. Pick the Cloudflare account. A Free-plan account is best, so the run shows which bindings need Workers Paid.
2. Settings → Environments → new borg-edge, with required reviewers (like npm).
3. Environment secrets: CLOUDFLARE_API_TOKEN (Workers Scripts, D1, Workers KV, R2 and Queues: Edit) and CLOUDFLARE_ACCOUNT_ID, for that account.
4. Repository variable BORG_EDGE=1.
5. Run borg-edge from the Actions tab once and approve it.
   • If the cost cap refuses a binding as Workers-Paid-only, or the deploy refuses one (Queues and R2 are the likely ones), either set BORG_ALLOW_PAID=1 or put that binding behind a flag in apps/borg/rustybuns.config.ts so the rest still deploys on Free.
6. Check the job summary: every check ✓, and every limit ✓ (refused). A limit the edge accepts means borg's number in apps/borg/README.md is wrong. Paste the grid here.
7. Check that destroy and the final sweep left nothing behind.

One run sits inside the free allowances.