Implement APS render fix and TSJS resilience

[aram356]

Summary

Implements the APS render fix and TSJS resilience design as a coordinated hard cutover on rc/202608. There is no backward-compatibility runtime, protocol alias, or dual-path migration layer.

• proxies the live APS runner through the first-party Fastly, Axum, Cloudflare, and Spin adapters without vendoring, pinning, storing, or caching APS bytes
• adds the strict APS renderer contract, MessageChannel/nonce lifecycle, reservation ownership, exact sizing, render diagnostics, and exact-once cleanup behavior
• replaces the former TSJS composition roots with one generated release catalog, one server-sealed boot transport, a size-admitted first-display agent, and atomic persistent-runtime takeover
• separates the source-neutral first-display render owner from the thin APS-specific strategy while preserving ADM/APS lifecycle parity
• incorporates origin/rc/202608 at 58532d7c42d2a59f8e87f0d643f8d0b109a680cb as the merge commit's second parent and preserves the applicable rc-owned behavior
• enforces content-addressed artifacts, release-ID validation, bundle admission, dependency direction, hard-cutover absence, lifecycle cleanup, and exact-head evidence binding

Deliberate boundaries

• rc/202608 is the PR base and release authority; its selected main ancestry is already included
• retired rc/july is represented only through the audited TSJS concepts rebuilt in the hard-cutover architecture
• no DynamoDB or Tinybird requirements
• no EdgeZero feature work in this feature scope
• no new analytics, experiment architecture, or APS runner cache
• no vendored APS runner, GPT runtime, PUC, or external Prebid bytes
• no APS runner digest or version pin; the runner remains a validated fixed-target live proxy concern
• stale pages reload at cutover rather than entering a compatibility path

The latest rc merge also preserves its unrelated release-owned inactive publisher cache/privacy and CLI volatile-slot audit changes. Those remain outside the APS runner and TSJS contracts; they do not introduce an APS cache or a second implementation path.

Architecture and load time

The parser-blocking persistent release is no longer the default first-display path. The generated bootstrap selects either:

• a size-admitted first-display artifact for the exact document mask, followed by protected paint and atomic takeover; or
• the persistent runtime directly when that mask is not admitted.

The checked-in bundle gate evaluates every reachable first-display mask. On this head the largest admitted first-display artifact is 89,978 / 90,000 raw bytes, 26,841 / 30,000 gzip bytes, and 23,639 / 26,000 Brotli bytes.

The generated APS performance smoke executes the actual independently minified APS slice and verifies fictional PUC, terminal state, protected paint, and takeover. Public cross-artifact and renderer-envelope keys are asserted after minification, including the authored publisherOrigin wire key.

Latest rc concepts preserved

• GPT requested-format opportunity facts are emitted immediately before the exact TS-owned request and seeded from authenticated first-display handoff data
• GPT diagnostics preserve requested, fill, and observed sizes as distinct evidence, with the only slot-size observer owned by deferred presentation
• rc GPT diagnostics presentation and operator wording improvements remain intact
• rc inactive publisher cache privacy/revalidation and CLI volatile-slot collision audit behavior remain intact
• duplicate APS runner helper cleanup remains intact; only the fixed-target live proxy owner remains

CI and supply-chain reliability

• GitHub Actions YAML remains declarative; executable orchestration is in checked-in script files under scripts/ and scripts/ci/
• no workflow synthesizes executable scripts or Playwright configuration at runtime
• hard-cutover and vendor-boundary scans reject retired runtime surfaces and APS/GPT/PUC vendor bytes
• performance and protected evidence workflows bind the requested head, base, release, and evidence identity

Final local checkpoint

• PR head: 4e05d86e518500a36477eb8b83e26092dbead88f
• feature parent: 558fae833ce1c2642da37d4ecab45a6c66072b91
• rc parent/base tip: 58532d7c42d2a59f8e87f0d643f8d0b109a680cb
• generated release: 7acdcbbef815a5640b91f2abb4db5fca502e716af0aee7f05c50fbb32902ae3d
• ancestry: exact rc tip is an ancestor of the PR head
• worktree: clean after the merge commit

Verification coverage

• TypeScript: 104 test files, 2,153 tests, zero type errors; 86 generated-release/fallback tests
• release: bundle admission, source ownership, architecture lint, APS contract, concept audit, and hard-cutover absence all pass
• Rust/Fastly: 163 adapter tests, 2,201 core tests, embedded-artifact tests, OpenRTB tests, and doctests pass
• fixture: sealed boot transport and 008b render-owner/creative/GPT mask pass
• performance smoke: 4 pass; 2 evidence-only cases skip without an evidence dispatch
• browser conformance: 63/63 pass across Chromium, Firefox, and WebKit
• formatting: Rust, TypeScript, and generated-release diff checks pass

Earlier in the same final-rc integration sweep, Axum, Cloudflare, Spin, cross-adapter parity, all target-matched clippy gates, the CLI suite, and all four APS proxy transport suites also passed. Fresh hosted CI is required on this exact PR head.

The PR remains a draft pending repository review, paired remote rc performance evidence, and the protected real-GAM attestation. No production deployment or protected real-GAM run was performed from this worktree.