Framework maximum lifetime for provider UIDs, including UIDs without an expiry #1548

Follow-up from PR #1487.

Description

ProviderExpiry::Unspecified maps to Expiry::Never, and a live provider UID is never due, so a UID with no stated expiry is never looked up again. If its provider is renamed or removed, the stored UID keeps being served from the source, and the new owner never looks it up because the source is not due.

Proposed direction: Clamp every provider UID, Unspecified included, to a framework maximum (for example 30 days, matching #1488's clamp). Gate egress by the stored UID's owner against the configured providers, and serve or prune provider-written records whose owner is no longer configured.

Done when

• Every provider UID, Unspecified included, is clamped to a framework maximum lifetime (for example 30 days).
• Egress of a stored UID is gated by its owner against the configured providers.
• Records owned by a provider that is no longer configured are pruned or not served.
• Tests cover Unspecified expiry, a renamed provider and a removed provider.

Affected area

Core (Edge Cookies, GDPR)

Code: ec/coordinator/validate.rs (expiry mapping); ec/coordinator/mod.rs (due_sources); ec/eids.rs (live_eids); ec/identify.rs.

Review threads

• Collect server-side identity provider EIDs in a single page-load write #1487 (comment)
• Collect server-side identity provider EIDs in a single page-load write #1487 (comment)