feat(tmp): standardize publisher targeting KV mapping

[bokelley]

Closes #6282.

Stacked on #6281. The second commit (2803f63f11) is the publisher-mapping follow-up; the first commit is exactly #6281 and will disappear from this PR when that dependency merges. This PR targets main now so the repository's full base-filtered CI runs against the complete stack.

What changed

• Add experimental /schemas/trusted-match/publisher-targeting-kv-config.json with a publisher-owned targeting_kv_mapping from (provider_id, provider-local key) to a local ad-server destination.
• Register the schema and document it alongside the existing TMPX publisher configuration pattern.
• Define exact, case-sensitive own-property lookup, independent dropping of unmapped tuples, and multi-value behavior when several tuples map to one destination.
• Preserve every mapped value, including exact duplicates; cross-provider value order is not significant.
• Extend executable vectors for provider/key case mismatches, prototype-chain hazards, shared destinations, duplicate values, and invalid configuration.
• Update canonical provider_id descriptions for both Context and Identity attribution roles.

Why

#6281 standardizes provider attribution on the wire. This follow-up standardizes the publisher-side configuration needed to translate attributed provider vocabulary into publisher-owned ad-server keys without router naming, fallback, or cross-provider collisions.

Validation

• Protocol, code, and Node.js test expert reviews: no remaining findings
• npm run test:schemas — 690 schemas plus 4 deprecation tests
• npm run test:examples — 79 examples plus 9 focused mapping tests
• npm run test:tmp-context-merge — 9/9
• compliance source/package reference checks
• docs JSON audit — 0 new findings
• docs navigation — 20/20
• schema UTF-8 and changeset scope checks
• unit suite — 1,037/1,037
• full current and 3.0-compat storyboard matrices across all six domains

The pre-commit full server suite exposed five unrelated replace-subscription mock-order failures; the exact file passed 23/23 in isolation. The stacked PR's GitHub Build Check is the authoritative clean-suite run.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated paths touched and required review not yet satisfied.

This PR modifies files under two hard, path-based approval gates (.github/workflows/** and static/schemas/source/**) while review_decision is REVIEW_REQUIRED (not APPROVED). Per decision rule row 2, the gate is not satisfied and the outcome must be escalate regardless of how clean the diff is. Human/CODEOWNERS approval is required before merge.

The reviewer surfaced no critical, high, or medium defects: the two hop-specific experimental schemas are disjoint via not.anyOf + additionalProperties: false (a known walker limitation, correctly not reported), schema↔docs coherence checks out, the new publisher-targeting-kv mapping is prototype-safe, and two changesets accompany the wire-surface change. Only one low finding (web.mdx wording) exists, which is non-blocking.

Additionally, static/schemas/source/trusted-match/provider-context-match-response.json and publisher-targeting-kv-config.json are new files (added) matching high-risk globs — inherently low risk as scaffolding, not an independent escalation trigger. The escalation here rests solely on the unsatisfied gated-paths gate.

Escalation reasons

• Touches static/schemas/source/** (protocol source of truth) and .github/workflows/build-check.yml — both under hard approval gates — while review_decision is REVIEW_REQUIRED. Human/CODEOWNERS review required.

Why human review

• Modifies gated paths (static/schemas/source/**, .github/workflows/build-check.yml) while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/build-check.yml (modified) matches .github/workflows/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/trusted-match/context-match-response.json (modified) matches static/schemas/source/**; static/schemas/source/trusted-match/provider-context-match-response.json (added) matches static/schemas/source/**; static/schemas/source/trusted-match/provider-registration.json (modified) matches static/schemas/source/**; static/schemas/source/trusted-match/publisher-targeting-kv-config.json (added) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.