Prevent 304 responses for SSAT root documents

[prk-Jr]

Summary

• Ensure eligible SSAT publisher document requests always receive a complete origin body so HTML synthesis and auctions run on reload.
• Prevent browser and Fastly revalidation by stripping conditional validators, bypassing Fastly readthrough caching, and returning synthesized HTML with Cache-Control: private, no-store.
• Fail closed with a non-cacheable 502 Bad Gateway and abandon the dispatched auction if an eligible origin unexpectedly returns 304 Not Modified.

Changes

File	Change
crates/trusted-server-core/src/platform/http.rs	Add a default-off platform HTTP cache-bypass option.
crates/trusted-server-core/src/platform/test_support.rs	Record cache-bypass behavior in the shared test client.
crates/trusted-server-adapter-fastly/src/platform.rs	Map cache bypass to Fastly set_pass(true) for synchronous and asynchronous sends.
crates/trusted-server-core/src/publisher.rs	Strip request and response validators, enforce private, no-store, reject unexpected eligible 304s, abandon auctions, and add regression coverage.
docs/superpowers/specs/2026-07-22-ssat-root-document-304-prevention-design.md	Document the approved behavior and scope.
docs/superpowers/plans/2026-07-22-ssat-root-document-304-prevention.md	Document the implementation and verification plan.

Closes #953

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (411 tests using pinned Node 24.12.0)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, 13 parity tests, 29 CLI proxy E2E tests, and cargo clippy-fastly

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code
• Uses project logging macros (not println!)
• New code has tests
• No secrets or credentials committed

[ChristianPavilonis]

Summary

Reviewed PR #952 against main. The Fastly path is covered, but one supported-adapter cache-bypass gap needs follow-up; it is included inline.

[ChristianPavilonis]

🔧 Cloudflare ignores the new cache-bypass contract

This marks eligible publisher requests for cache bypass, but CloudflareHttpClient::execute never reads bypass_cache: its worker::RequestInit retains the default cache mode. Cloudflare Workers fetch supports CacheMode::NoStore, and without setting it an eligible navigation can still be satisfied by configured/default Cloudflare cache behavior rather than receiving a complete origin body. That leaves the PR's SSAT invariant incomplete on a supported adapter.

Please map bypass_cache to init.with_cache(CacheMode::NoStore) in the Cloudflare adapter and add a regression test for that mapping.