Do not send a cookie EC with no row as user.id #1549

Follow-up from PR #1487.

Description

A well-formed ts-ec cookie whose row does not exist still goes to bidders as user.id (and as request.id = ts-{ec}) on the navigation auction, page-bids and /auction. Orphan recovery then rotates the EC on the navigation, so bidders received an ID that is abandoned immediately. This matches main, so it is not a regression.

Reproduction steps

1. Configure an enabled identity provider (fictional example: example-provider, https://id.example.com).
2. Exercise the path described above with a test EC (for example ec-0000-test).
3. Observe the behaviour described.

Expected behavior

Set user.id only when kv_snapshot().entry_for(ec) holds a consented row, the same rule provider dispatch now uses. Document it as a bidder-visible change.

Acceptance criteria

• user.id (and request.id = ts-{ec}) is set only when the snapshot holds a consented row for the EC, on the navigation auction, page-bids and /auction.
• A cookie EC with no row produces no user.id, pinned by a test.
• The change is documented as bidder-visible (CHANGELOG).

Affected area

Core (Edge Cookies, GDPR)

Code: crates/trusted-server-core/src/publisher.rs (the user.id filter near the auction build); auction/endpoints.rs (the /auction snapshot read).

Version

main with PR #1487 (feat/s2s-eid-after-response).

Review threads

• Collect server-side identity provider EIDs in a single page-load write #1487 (comment)