[dhruv8sh]

Summary

• Makes the SharedID provider follow Prebid's definition: it reads the cookie named in Prebid's sharedId module config, defaults its source to pubcid.org (atype 1), and keeps a stored SharedID for as long as the row exists.
• Swaps core's blanket deploy-time rejection of enabled identity providers for the registered-kind check that ts config already runs. Core can't see the provider crate's kinds, so it refused every enabled provider at deploy.

Changes

File	Change
crates/trusted-server-core/src/ec/provider.rs	New IdentityProvider::keeps_stored_uids hook, defaulting to false. When it returns true, a live stored UID wins over a different cookie value.
crates/trusted-server-core/src/ec/coordinator/mod.rs	Skips cookie IDs for sources that already hold a live UID when the provider keeps stored UIDs. Two tests cover it.
crates/trusted-server-core/src/settings.rs	A sharedid provider with no sources claims pubcid.org. This uses serde(remote = "Self") so the default is applied once, at deserialization.
crates/trusted-server-identity-providers/src/sharedid.rs	Cookie and generated IDs carry no expiry, so they last as long as the row. Turns on keeps_stored_uids. Updates the docs and tests.
crates/trusted-server-identity-providers/src/lib.rs	Fills cookie_names from integrations.prebid.managed_user_ids[].storage.name for the sharedId/pubCommonId module when its storage type is a cookie and the provider doesn't set its own names. Adds a test that validate_providers refuses an unregistered kind.
crates/trusted-server-core/src/config.rs	Removes reject_providers_without_a_kind. ts config builds each enabled provider and refuses unregistered kinds.
trusted-server.example.toml	Updates the SharedID example to match.

Behaviour

• With storage = { type = "cookie", name = "_pubcid" } on the Prebid sharedId module, only _pubcid is read. A cookie named sharedId is not.
• A stored SharedID survives a request that carries a different cookie value. A cookie is taken only when the row holds no live SharedID.
• The _pubcid_optout cookie still wins. Reading and storing still need EC consent plus EID consent (TCF Purposes 1 and 4), which the coordinator already enforces before reading cookies.

Not in this PR

• ts config checks provider kinds but not the target adapter. Pushing an enabled provider to Axum, Cloudflare or Spin still fails at startup, as before.
• LiveRamp's Custom ID mapping still needs a decision.

Closes

Follow-up into #1488 (base branch feat/s2s-eid-vendors). No linked issue.

Spec

Spec: implements review follow-ups to #1488, whose spec lives in that stack.

Test plan

• cargo test-fastly && cargo test-axum (also cargo test-cloudflare, cargo test-spin)
• cargo clippy-fastly && cargo clippy-axum (also clippy-cloudflare, clippy-cloudflare-wasm, clippy-spin-native, clippy-spin-wasm, clippy-cli, clippy-codegen)
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (1838 passed, 1 skipped, on the pinned Node 24.20.0)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: ./scripts/test-cli.sh; cargo test -p trusted-server-identity-providers (110 passed)

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds (not applicable: review follow-up to Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488)
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed