Fix Prebid User ID diagnostics

[ChristianPavilonis]

Summary

• Report the exact User ID modules compiled into each publisher-specific Prebid bundle.
• Refresh diagnostics when auctions begin so late publisher configuration is visible without repeating warnings.
• Add PAIR ID and lockr AIM to the supported User ID module registry.
• Preserve vendor-specific OpenRTB EID atype values end-to-end, including PAIR's required 571187.
• Exercise the production external-bundle wiring in an isolated smoke test.

Why atype changed from u8 to i32

OpenRTB EID agent types are not limited to the standard single-byte values. The canonical Prebid PAIR EID uses source: "google.com" and atype: 571187, which cannot fit in a Rust u8 (maximum 255). The previous JS and Rust sanitizers therefore silently removed PAIR's atype before the EID reached the downstream Prebid request.

Uid.atype and the EC partner configuration/runtime path now use i32, matching the generated OpenRTB model and preserving vendor-specific values such as 571187. Browser input, auction payloads, cookies, configured EC partners, KV-resolved EIDs, and downstream serialization all enforce a non-negative signed 32-bit range; negative or oversized values are rejected or omitted rather than propagated.

Changes

Area	Change
External Prebid build	Exports the exact selected User ID module list from generated bundle imports and verifies the production builder/alias wiring with an isolated smoke test.
Prebid browser integration	Uses generated module metadata, refreshes diagnostics at requestBids(), deduplicates warnings, and preserves non-negative atype values through i32::MAX.
User ID registry	Registers pairIdSystem and lockrAIMIdSystem.
Rust OpenRTB and auction parsing	Widens UID atype from u8 to i32 and preserves PAIR's 571187.
EC configuration and cookies	Widens configured, structured-cookie, legacy-cookie, and KV-resolved agent types while validating or sanitizing negative values.
Regression coverage	Covers JS auction payloads, both cookie formats, EC configuration and KV continuity, Rust model serialization, downstream Prebid serialization, and the real external bundle.

Closes

Closes #886

Test plan

• cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin
• cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm
• cargo fmt --all -- --check
• JS build and tests: cd crates/trusted-server-js/lib && npm run build && npx vitest run
• JS lint and format: cd crates/trusted-server-js/lib && npm run lint && npm run format
• Docs format: cd docs && npm run format
• Release WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() added
• Uses the existing JS logging wrapper; no println!-style output added
• New code has tests
• No secrets or credentials committed