Reduce EID KV write conflicts during page loads

[ChristianPavilonis]

Summary

• Limit returning-user EID cookie persistence to publisher document navigations and POST /auction; new EC creation remains eligible.
• Replace immediate five-write CAS retry loops with one conditional write and one follow-up read.
• Preserve consent withdrawal and defer differing browser-cookie values when trustworthy value freshness is unavailable.

This PR is stacked on #903.

Changes

Area	Change
Fastly routing	Classify navigation and auction requests as allowed EID sync sources; static, analytics, integration, and other subresources remain ineligible.
EC finalization	Keep consent and cookie handling before the EID sync boundary, while collecting cookie updates only for eligible sources.
KV persistence	Add missing IDs with one CAS write; after conflict, reread once and report matched, deferred, withdrawn, missing, or failed outcomes without retrying. Different existing values are conservatively preserved because the cookies have no value-owned version.
Observability	Emit bounded, identity-free fields for attempts, matches, writes, duplicate conflicts, deferrals, outcomes, and source.
Tests	Cover route classification, new/returning EC behavior, one-write conflict convergence, concurrent withdrawal, conservative freshness, and measurement dimensions.

Closes

Closes #993

Test plan

• cargo fmt --all -- --check
• cargo test-fastly
• cargo test-axum
• cargo test-cloudflare
• cargo test-spin
• Cross-adapter parity tests
• Fastly, Axum, Cloudflare, Cloudflare Wasm, Spin native, and Spin Wasm Clippy targets
• cd crates/trusted-server-js/lib && npm run format && npm run lint && npm test
• cd docs && npm run format && npm run lint && npm run build
• Fastly and Spin release Wasm builds

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() added in production code
• Uses log macros rather than println!
• New behavior has regression coverage
• No secrets, EC IDs, or partner ID values are emitted by new measurements