Prevent duplicate GPT slot requests

[ChristianPavilonis]

Summary

• Prevent competing GPT requests when TS initializes a placement before the publisher defines its inner div.
• Hand the TS-created inner-div slot to the late publisher definition and preserve SPA ownership cleanup.

Changes

File	Change
crates/trusted-server-js/lib/src/integrations/gpt/index.ts	Define fallback slots on the inner div and add scoped late-publisher definition/display/refresh handoff wrappers.
crates/trusted-server-js/lib/src/core/types.ts	Add shared window.tsjs handoff lifecycle state.
crates/trusted-server-core/src/integrations/gpt_bootstrap.js	Mirror the initial-load handoff behavior in the head bootstrap.
crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts	Add request-level tests for late definitions and disableInitialLoad().
crates/trusted-server-core/src/integrations/gpt.rs	Assert the injected bootstrap uses inner-div handoff behavior.
docs/superpowers/{specs,plans}/	Add the design specification and implementation plan.

Closes

Closes #944

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-axum; target-matched trusted-server-core GPT tests; cargo clippy-axum

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed