[dhruv8sh]

Summary

• Turns pull sync into an identity provider that runs on publisher navigations, so pull-synced partner IDs flow through the same coordinator, deadline and single page-load KV write as other providers.
• Mirrors provider-owned bidstream UIDs to a JS-readable __Host-ts-eids-mirror cookie so publisher-side code can read them, on a best-effort basis.
• Rejects batch sync records for sources a provider owns, so batch sync cannot overwrite provider-owned EIDs.

Stacked on #1487; review only the four commits on top of it.

Changes

Commit	Change
Reject batch sync records for provider-owned sources	ec/batch_sync.rs, ec/registry.rs: batch sync rejects records whose source is owned by a configured identity provider
Run pull sync as an identity provider on navigations	New trusted-server-identity-providers/src/pull_sync.rs; removes core ec/pull_sync.rs / ec/pull_sync_marker.rs and the post-send pull sync path in the Fastly adapter. Pull sync now runs within the provider coordinator on navigations and honours pull_sync_concurrency
Mirror provider-owned bidstream UIDs to a JS-readable cookie	New ec/mirror.rs; ec/finalize.rs, ec/cookies.rs, constants.rs write the __Host-ts-eids-mirror cookie
Make mirroring best effort and fix pull sync validation	Mirror failures no longer fail the response; the mirror cookie is expired only when the browser sent one; pull sync config validation fixes in settings.rs / config.rs; docs in docs/guide/edge-cookies.md and configuration.md

Closes

Part of #1246 and #1245; the provider implementations that close them come in follow-up PRs.

Spec

Spec: reviewed separately; not included in this PR.

Test plan

• cargo test-fastly && cargo test-fastly-reuse && cargo test-axum && cargo test-cloudflare && cargo test-spin
• All eight clippy aliases
• cargo fmt --all -- --check
• Parity tests, native template build-digest test and clippy, scripts/lint-wasm-clock.sh
• JS tests, format and lint
• Docs format and Markdown prettier check
• ./scripts/test-cli.sh, domain lint against the base branch, CI Node pin guard
• Fastly EC integration tests (left to CI)
• Manual testing via fastly compute serve

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed