Cloudflare Worker panics when a server-side auction runs (std::time::Instant::now() on wasm32-unknown-unknown) #1240

On the Cloudflare adapter, every HTML request that dispatches a server-side auction crashes the Worker.

Reproduce

Build the Cloudflare adapter with worker-build and run it under wrangler dev --local with a server-side auction configured. Request an HTML page that dispatches the auction. The Worker fails with:

Rust panic: panicked at library/std/src/sys/time/unsupported.rs:13:9
RuntimeError: unreachable
  ...
  trusted_server_core::auction::telemetry::AuctionObservationContext::from_parts

We reproduced this at 666953a0. The same calls are still present on main at 80483011.

Cause

AuctionObservationContext::from_parts in auction/telemetry.rs calls std::time::Instant::now(). The standard library has no clock on wasm32-unknown-unknown, so the call panics. Current CI does not reach it: cargo clippy-cloudflare-wasm compiles the code but cannot know that the call panics, and cargo test-cloudflare runs on the native host, where the std clock works.

Reading trusted-server-core for the same calls found three more request-path sites that run on Cloudflare. We have not exercised these on a live Worker:

• integrations/datadome/protection_scope.rs: protection-scope cache expiry (two Instant::now() calls).
• publisher.rs: template-cache expiry (Instant::now()) and origin_shared_ttl (SystemTime::now()).

Proposed fix

Take Instant and SystemTime from web_time. It is already a dependency of trusted-server-core, and auction/orchestrator.rs, prebid.rs and proxy.rs already use it. On Fastly, Axum and Spin, web_time re-exports the std types, so nothing changes there.

To keep the std calls from coming back, add a clippy disallowed-methods check that runs only on wasm32-unknown-unknown, with its own config. A rule in the workspace clippy.toml does not work: on the other targets the web_time types are the std types, so the rule flags correct code too. In our trial it produced about 36 false positives in cargo clippy-fastly.

We have this as one commit with the lint. Without the fix the lint reports all six call sites; with it the lint is clean. The fmt, clippy (all eight aliases), test-fastly, test-axum, test-cloudflare, test-spin and parity gates pass. After the fix, the same wrangler dev --local setup served the auction page with bids, and the bidder received exactly one request. If this direction is acceptable, we will open the PR against current main.