Harden PR 1079 first-impression arbitration

[prk-Jr]

Summary

• Preserve the first-claimant policy from Prevent competing GPT first impressions and resize PUC shells #1079 while preventing overlapping or delayed publisher auctions from overwriting an impression already committed by Trusted Server.
• Bind publisher delivery and creative rendering to the current navigation, exact physical slot element, authenticated iframe, and winning bid so stale callbacks cannot affect replacement slots.
• Expand every collapsed GAM shell around a valid APS creative while refusing fixed, anchor, vignette, interstitial, detached, oversized, or unauthenticated frames.

This PR is intentionally stacked on #1079 and should be reviewed as the delta from fix/gpt-first-impression-aps-shell.

Changes

File	Change
crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts	Extend browser coverage for nested collapsed APS creative shells.
crates/trusted-server-js/lib/src/core/first_impression.ts	Make publisher suppression token-local and retain bounded TS-owned tombstones for late correlated callbacks.
crates/trusted-server-js/lib/src/core/types.ts	Replace claim-wide suppression consumption with publisher-registration closure state.
crates/trusted-server-js/lib/src/integrations/gpt/index.ts	Revalidate creative ownership before side effects and safely resize every collapsed ancestor through the authenticated slot root.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Scope publisher auctions and correlation by requested units, generation, and element identity; serialize delayed refresh delivery and forward only unsuppressed slots.
crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts	Cover stale creative rejection, nested shell expansion, and guarded render outcomes.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Add regressions for overlapping auctions, late callbacks, wrapper composition, scoped requests, stale navigation state, and mixed refresh lists.
crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs	Align artifact integration expectations with the hardened delivery flow.
docs/superpowers/plans/2026-08-27-pr-1079-review-remediation.md	Record the implementation and verification plan for the review remediation.
docs/superpowers/specs/2026-08-27-pr-1079-review-remediation-design.md	Document the ownership, refresh suppression, and creative bridge design.

Closes

Issue number intentionally omitted per request.

Test plan

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare
• cargo clippy-fastly && cargo clippy-axum
• cargo clippy-cloudflare
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM production build
• Manual testing via fastly compute serve

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() added to production code
• Logging uses the existing TS logger; no Rust logging was added
• New behavior has regression coverage
• No secrets or credentials committed