fix: anonymousId does not resync once localStorage and the shared cookie disagree

[abueide]

Summary

Split out from #1397, which addresses one source of the underlying anonymousId/userId cross-subdomain divergence issue (see #706). This PR addresses the actual store-reconciliation gap.

localStorage is per-origin, but sits ahead of the shared, cross-subdomain cookie in the default store priority ([localStorage, cookie, memory]). Once the two disagree -- for any reason (cookie eviction, a consent tool clearing cookies pre-consent, a past tld() failure, a user clearing cookies/site data on just one subdomain, etc.) -- whichever value is in localStorage wins forever on that origin, with no way for it to resync to the cookie. Each origin can then end up parroting a different anonymousId back into the shared cookie, causing it to visibly ping-pong between subdomains.

• Added UniversalStorage#getConsistent: when the underlying stores disagree, the cookie's value wins and every store is resynced to it, instead of the divergence persisting indefinitely. When stores already agree (the common case), this returns the exact same value getAndSync would.
• An empty string is treated the same as no value, so a cookie that was blanked out rather than deleted (e.g. a third-party script running document.cookie = 'ajs_anonymous_id=;path=/' with no expiry) can't win a disagreement and wipe out a real id elsewhere.
• Gated behind a new opt-in resolveAnonymousIdConflicts option (user: { resolveAnonymousIdConflicts: true } in load options), off by default. anonymousId() only switches from getAndSync to getConsistent when it's enabled. This ships in a release without changing anyone's behavior; it can be staged in with specific customers/accounts before considering flipping the default in a later release. (There's no infra-level staged-rollout mechanism in this repo to hook into for a true percentage rollout -- this opt-in flag is the equivalent we can offer at the application-config level.)

A deterministic reproduction (from #706's own report)

The original reporter on #706 already described a concrete, deterministic trigger, independent of any probe flakiness:

1. User is on subdomain A. They clear cookies + site data for that origin. This deletes the shared cookie entirely (its Domain covers both subdomains, so it's visible/clearable from A) and subdomain A's own localStorage entry (localStorage is origin-scoped, so this doesn't touch B).
2. Subdomain B was never visited during this -- its localStorage still holds the old id, untouched.
3. Back on A: both localStorage(A) and the cookie are empty, so a fresh id (NEW) is generated and written to both.
4. User navigates to B: localStorage(B) still has the old id (OLD), the cookie now has NEW. localStorage outranks the cookie in priority order, so B returns OLD -- and getAndSync writes that back to every store, overwriting the shared cookie with OLD.
5. User navigates back to A: localStorage(A) has NEW, the cookie now has OLD (just clobbered in step 4) -- A's localStorage wins, returns NEW, overwrites the cookie back to NEW.

Steps 4-5 repeat indefinitely -- exactly the reporter's "the cookie value for the TLD seemingly switching between these values as you navigate between the pages," with no probe failure or flakiness required.

With resolveAnonymousIdConflicts enabled: the next visit to either subdomain reads both stores, sees they disagree, and takes the cookie's value -- resyncing the losing localStorage entry to match. Both subdomains converge on the same id after one round trip and stay converged; the ping-pong stops for good, regardless of which id happened to win.

Test plan

• Added unit tests for UniversalStorage#getConsistent, including the empty-string edge case (packages/browser/src/core/storage/__tests__/universalStorage.test.ts)
• Added User tests confirming the flag defaults off (unchanged behavior) and confirming the reported drift scenario self-heals when enabled (packages/browser/src/core/user/__tests__/index.test.ts)
• Added a Playwright e2e test reproducing the exact Cross-domain tracking and clearing of LocalStorage #706 sequence across two real (mocked) same-site subdomains, confirming both the bug (without the flag) and the fix (with it) (packages/browser-integration-tests/src/anonymous-id-subdomain-sync.test.ts)
• Full packages/browser test suite passes
• tsc --noEmit and eslint clean on all touched files

[changeset-bot]

🦋 Changeset detected

Latest commit: d3209cd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@segment/analytics-next	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.59%. Comparing base (0c4fa88) to head (3679ef5).

⚠️ Current head 3679ef5 differs from pull request most recent head d3209cd

Please upload reports for the commit d3209cd to get more accurate results.

Files with missing lines	Patch %	Lines
...kages/browser/src/core/storage/universalStorage.ts	88.23%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1398      +/-   ##
==========================================
- Coverage   91.59%   91.59%   -0.01%     
==========================================
  Files         127      127              
  Lines        4142     4163      +21     
  Branches     1033     1040       +7     
==========================================
+ Hits         3794     3813      +19     
- Misses        348      350       +2     

Flag	Coverage Δ
browser	92.50% <91.66%> (-0.02%)	⬇️
core	90.07% <ø> (ø)
node	89.43% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.