Prevent 304 responses for SSAT root documents

[prk-Jr]

Summary

• Ensure eligible SSAT publisher document requests always receive a complete origin body so HTML synthesis and auctions run on reload.
• Prevent browser and Fastly revalidation by stripping conditional validators, bypassing Fastly readthrough caching, and returning synthesized HTML with Cache-Control: private, no-store.
• Fail closed with a non-cacheable 502 Bad Gateway and abandon the dispatched auction if an eligible origin unexpectedly returns 304 Not Modified.

Changes

File	Change
crates/trusted-server-core/src/platform/http.rs	Add a default-off platform HTTP cache-bypass option.
crates/trusted-server-core/src/platform/test_support.rs	Record cache-bypass behavior in the shared test client.
crates/trusted-server-adapter-fastly/src/platform.rs	Map cache bypass to Fastly set_pass(true) for synchronous and asynchronous sends.
crates/trusted-server-core/src/publisher.rs	Strip request and response validators, enforce private, no-store, reject unexpected eligible 304s, abandon auctions, and add regression coverage.
docs/superpowers/specs/2026-07-22-ssat-root-document-304-prevention-design.md	Document the approved behavior and scope.
docs/superpowers/plans/2026-07-22-ssat-root-document-304-prevention.md	Document the implementation and verification plan.

Closes #953

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (411 tests using pinned Node 24.12.0)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, 13 parity tests, 29 CLI proxy E2E tests, and cargo clippy-fastly

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code
• Uses project logging macros (not println!)
• New code has tests
• No secrets or credentials committed