Restore publisher streaming integration lost in APS rebase

Rebasing the APS OpenRTB stack onto main resolved publisher.rs against its
pre-streaming shape: the file reverted to the buffered design while
streaming_processor.rs kept the end-to-end machinery from #867, leaving
BodyStreamDecoder/BodyStreamEncoder and their helpers dead. With CI denying
warnings, every workflow failed at compile (struct BodyStreamDecoder is never
constructed, plus 8 sibling errors), so no tests ran on the branch.

Re-merge publisher.rs three-way (base: pre-streaming main, ours: branch tip,
theirs: main) so the file carries main's #867 async streaming and inline SSAT
rendering with the APS additions reapplied on top:

- build_bid_map keeps main's signature (settings, request_origin,
  include_debug_bid), the zero-dimension w/h omission, and the always-inline
  sanitized adm path, plus the APS renderer field and the renderer-aware
  hb_adid fallback (cache_id, then renderer bid_id, then ad_id)
- the APS bid-map test moves to the new signature; the include_adm debug flag
  it exercised is superseded by main's debug_bid design

Also update debug_metadata_preserves_malformed_and_error_responses for the
fail-closed debug-header allowlist from the APS security review: content-type
is preserved, retry-after is redacted. The compile failure had masked this
test regression since the allowlist landed.

Author: aram356

crates/trusted-server-core/src/integrations/aps.rs

@@ -1846,6 +1846,7 @@ mod tests {
         let unavailable = PlatformResponse::new(
             edgezero_core::http::response_builder()
                 .status(StatusCode::SERVICE_UNAVAILABLE)
+                .header("content-type", "text/plain")
                 .header("retry-after", "5")
                 .body(EdgeBody::from(b"temporarily unavailable".to_vec()))
                 .expect("should build unavailable APS response"),
@@ -1877,8 +1878,17 @@ mod tests {
         assert_eq!(unavailable_call["status"], 503);
         assert_eq!(unavailable_call["responsebody"], "temporarily unavailable");
         assert_eq!(
-            unavailable_call["responseheaders"]["retry-after"],
-            json!(["5"])
+            unavailable_call["responseheaders"]["content-type"],
+            json!(["text/plain"]),
+            "should preserve allowlisted headers in debug metadata"
+        );
+        assert!(
+            unavailable_call["responseheaders"]
+                .as_object()
+                .expect("should include response headers")
+                .get("retry-after")
+                .is_none(),
+            "should redact headers outside the fail-closed allowlist"
         );
         let oversized_call = oversized.metadata["debug"]["httpcalls"]["aps"][0]
             .as_object()