fix(tmp): settle router merge semantics for 3.2

[bokelley]

Summary

This is the bounded 3.2 ratification packet for #5721 and #5722:

• Context Match duplicate offers use the configured provider priority (lower value wins), with response arrival only as an equal-priority tie-breaker
• Identity Match eligibility is explicitly a union over successful responders
• omission remains silent rather than becoming an ineligibility vote or quorum failure
• zero, one, and multiple-responder cases are spelled out
• duplicate positive identity claims remain eligible but produce an operator warning

This makes the proposed Identity Match behavior change explicit and removes the contradictory merge rules without reopening TMP design.

Paired reference implementation: adcontextprotocol/adcp-go#428

Verification

• node --test tests/tmp-router-merge-semantics.test.cjs
• schema validation
• changeset scope validation

Closes #5721.
Closes #5722.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS review.

This PR modifies static/schemas/source/trusted-match/provider-registration.json, which matches the deterministic hard approval gate glob static/schemas/source/** (gated_paths: true). review_decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires: the gate is not satisfied and the PR cannot be auto-approved.

Substantive review is clean. The reviewer found no critical/high/medium findings. The change settles the TMP router merge semantics (Context Match → provider-priority-with-arrival-tiebreak; Identity Match eligibility → explicit responder-scoped union preserving silent-ignore privacy). It resolves a pre-existing schema↔docs contradiction, ships a class-appropriate minor changeset (trusted-match is x-status: experimental), and no stale intersection language or contradicted decision record survives. Once a human/CODEOWNERS review lands as APPROVED, this falls through to a normal approve.

Blocking findings: none.

Escalation reason: static/schemas/source/trusted-match/provider-registration.json is under a hard approval gate and requires human/CODEOWNERS review (review_decision: REVIEW_REQUIRED).

Note: one low-severity nit — the schema priority description omits the identity carve-out the spec table now states (provider-registration.json:64). Not blocking.

Why human review

• Modifies static/schemas/source/trusted-match/provider-registration.json — under the hard approval gate (static/schemas/source/**); review_decision is REVIEW_REQUIRED, not APPROVED, so human/CODEOWNERS review is required.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/trusted-match/provider-registration.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.