Restore versioned TSJS URLs in creative rewriting

[ChristianPavilonis]

Summary

Restore content-versioned TSJS URLs in production creative rewriting without advertising a hash that does not match the enabled immediate module set.

PR #860 intentionally made the registry-free TSJS helper unversioned because it cannot calculate an honest module-set hash. The production creative paths currently use that fallback, so creative iframes may retain the prior unified bundle for the short fallback TTL after deployment.

Scope

• Thread the exact immediate TSJS module IDs, or a precomputed tsjs_script_src, through:
  • direct auction creative rewriting;
  • CreativeHtmlProcessor for proxied creatives.
• Keep the registry-free Testlight serde default unversioned.
• Avoid calculating a hash from all_module_ids() when the serving path uses only enabled immediate modules.

Acceptance criteria

• Rewritten production creative HTML contains /static/tsjs=tsjs-unified.min.js?v=<hash> for the exact enabled immediate module set.
• Requesting that URL receives the immutable TSJS policy.
• Direct auction and proxied creative paths have coverage.
• The Testlight registry-free default remains unversioned.

References

• PR Implement configurable cache header policies #860
• crates/trusted-server-core/src/tsjs.rs
• crates/trusted-server-core/src/creative.rs
• crates/trusted-server-core/src/auction/formats.rs
• crates/trusted-server-core/src/proxy.rs