Add per-cookie template cache policy

[prk-Jr]

Summary

• Separate shared HTML templates by bounded cookie variants, so experiment arms remain isolated when a downstream CDN derives a variant header after TS has selected its cache key.
• Route requests carrying configured session cookies inline without shared lookup or storage. Scope the existing cookie-independence assertion to unlisted cookies while preserving conservative defaults and unconditional Vary: Cookie refusal.
• Validate configuration and ambiguous prepared cookie input while tolerating compact JSON and comma-list values in ignored cookies. Preserve existing request preparation and cover variant isolation, session bypass, reader assembly, and rollback.

Changes

File	Change
crates/trusted-server-core/src/creative_opportunities.rs	Add optional key/bypass cookie lists, case-sensitive name validation, scoped independence documentation, and configuration tests.
crates/trusted-server-core/src/cookies.rs	Register the internal template-cookie policy module.
crates/trusted-server-core/src/cookies/template_cache_policy.rs	Evaluate all prepared cookie fields; distinguish absence from empty values; retain strict key-cookie values and duplicate rejection while allowing bounded JSON/comma-list syntax for ignored cookies.
crates/trusted-server-core/src/platform/template_cache.rs	Add framed, hashed cookie dimensions while preserving legacy keys when dimensions are empty; redact values in Debug output.
crates/trusted-server-core/src/platform/mod.rs	Export the cookie dimension type.
crates/trusted-server-core/src/publisher.rs	Reuse one cookie decision for lookup and storage; add end-to-end regressions, distinct bids on warm hits, and outbound Cookie assertions.
crates/trusted-server-adapter-fastly/src/template_cache.rs	Update the cache-key fixture with empty cookie dimensions.
trusted-server.example.toml	Document optional policies, bounded variants, downstream header coverage, and safe rollback.
docs/guide/configuration.md	Explain combined and independent deployment patterns, eligibility, limitations, and rollback.
docs/superpowers/specs/2026-09-08-1138-per-cookie-template-cache-policy-design.md	Record the reviewed behavior and request-preparation boundary.
docs/superpowers/plans/2026-09-08-1138-per-cookie-template-cache-policy.md	Record implementation steps and validation results.

Ignored-value tolerance applies only when independence is asserted. Names, key values, and cookie framing remain validated; unmatched quotes, unsafe bytes, and comma-delimited cookie assignments still bypass. The origin must treat ignored values as opaque and parse semicolon-separated cookies independently; parsers that stop at nonstandard values cannot safely make this assertion.

Closes

Closes #1138

Test plan

The checks below were run during implementation. No local CI gates were rerun for PR creation. Full repository verification passed at 80d462df; after the test-only follow-up ba5b88d5, the full Fastly/core suite, Fastly Clippy, and Rust formatting passed again. The compatibility fix at d38c0d3a was verified with 23 focused cookie tests, the full Fastly suite (170 adapter, 2,479 core, 2 JS Rust, and 21 OpenRTB tests), Fastly Clippy, Rust formatting, and formatting of the changed Markdown files. The additional cookie-order fixture passed in a subsequent focused evaluator run.

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run — 45 files, 893 tests passed.
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM release build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1 — not run.
• Manual testing via fastly compute serve — not run.
• Other: Cloudflare and Spin tests; Cloudflare native/WASM and Spin native/WASM Clippy; 13 integration parity tests; JS build.
• Cookie policy regressions: downstream A/B isolation, warm/cold session bypass, absent/empty variants, independent lists, malformed prepared input, unchanged response guards, and policy invalidation.
• Mutation check: omitting cookie dimensions causes arm B to hit arm A's template; the regression fails as expected. Implementation restored before final verification.
• Independent specification and code reviews; test improvements and ignored-cookie compatibility fix independently reviewed.
• Headless Chrome through local Viceroy/proxy against Autoblog with the supplied JSON cookie present: separate A/B miss-stored → hit sequences and session bypass-request, all HTTP 200. Page JavaScript was disabled to keep cookies stable.
• JSON regression tests failed before the fix, then passed; both publisher finalizers preserve forwarded cookies and bypass session lookup/storage.

Viceroy tests required macOS keychain access, and Axum HTTP tests required loopback socket access. Sandbox-related failures passed after rerunning with the required access.

Checklist

• Changes follow CLAUDE.md conventions.
• No new unwrap() in production code.
• Uses log macros, not println!, per project conventions.
• New code has tests.
• No secrets or credentials committed.