Centralize DOM insertion guards

[prk-Jr]

Summary

• Centralize SDK DOM insertion interception behind a single shared dispatcher so integrations no longer stack independent appendChild / insertBefore wrappers.
• Move GPT onto the shared dispatcher and harden its proxy path so dynamic GPT loads remain first-party without broadening upstream encoding negotiation.
• Add coordination and reset coverage so SPA re-inits, test runs, and future integrations do not accumulate prototype patches.

Changes

File	Change
crates/common/src/integrations/gpt.rs	Switched GPT asset fetching to the shared proxy helper, preserved caller Accept-Encoding, updated bootstrap comments, and refreshed proxy tests/fixtures.
crates/js/lib/src/shared/dom_insertion_dispatcher.ts	Added the runtime-global DOM insertion dispatcher that owns the single appendChild / insertBefore patch, orders handlers deterministically, and restores baselines safely.
crates/js/lib/src/shared/script_guard.ts	Refactored shared script guards to register dispatcher handlers instead of patching DOM prototypes directly.
crates/js/lib/src/integrations/gpt/script_guard.ts	Moved GPT Layer 5 onto the shared dispatcher and coordinated reset through handler unregistering.
crates/js/lib/src/integrations/gpt/index.ts	Made GPT shim activation robust when the inline enable flag executes before the unified bundle.
crates/js/lib/src/integrations/datadome/script_guard.ts	Updated DataDome to the new shared guard API and aligned guard comments with dispatcher behavior.
crates/js/lib/src/integrations/google_tag_manager/script_guard.ts	Updated GTM to the new shared guard API with stable integration identity.
crates/js/lib/src/integrations/lockr/nextjs_guard.ts	Updated Lockr to the new shared guard API and aligned guard comments with dispatcher behavior.
crates/js/lib/src/integrations/permutive/script_guard.ts	Updated Permutive to the new shared guard API with stable integration identity.
crates/js/lib/test/shared/dom_insertion_dispatcher.test.ts	Added shared-dispatcher coverage for single patch ownership, ordering, reset coordination, external patch ownership, handler isolation, and repeated install/reset cycles.
crates/js/lib/test/integrations/gpt/index.test.ts	Added coverage for GPT auto-install when the enable flag is set before module evaluation.
crates/js/lib/test/integrations/gpt/script_guard.test.ts	Updated GPT guard tests for dispatcher-based reset behavior and realistic versioned GPT asset paths.
crates/js/lib/test/integrations/datadome/script_guard.test.ts	Updated DataDome guard tests to assert reset restores shared prototype baselines without manual prototype cleanup.
crates/js/lib/test/integrations/google_tag_manager/script_guard.test.ts	Updated GTM guard tests to assert reset restores shared prototype baselines without manual prototype cleanup.
crates/js/lib/test/integrations/lockr/nextjs_guard.test.ts	Updated Lockr guard tests to assert reset restores shared prototype baselines without manual prototype cleanup.

Closes

Closes #402

Test plan

• cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cd crates/js/lib && npm run build

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed