Gate Surface tag tracking on form-scoped cookie consent

[0xgautam]

The Surface tag currently reads visitor storage and starts environment-only journey tracking before knowing the form's cookie policy. This change resolves each registered form's privacy settings first and gates host cookie capture, recognition, journeys and parent conversions, while preserving operational HTML-form submission when tracking is denied.

Implements the scripts handoff for https://github.com/trysurface/surface_forms/pull/5811, pinned to 7d525ac12caf9f8a8475551e907929d46dbc4dc0. The Forms PR is still a draft; this tag requires a compatible API/renderer deployment.

Changes

• Three-field complete-snapshot consent API, shared with the actual Forms SDK bridge in either load order. Shared host policy intersects registered iframe, lazy-embed and external-form contexts; unresolved, malformed, no-form and mixed-environment scopes fail closed.
• Runtime-config validation, exact iframe source/origin registration, consent-first replay, per-frame prefill and payloads, marketing/journey cookie allowlists, gated Dreamdata identity transport, and sanitized iframe/host URL copies.
• Form-scoped optional recognition and a separate in-memory operational capability for HTML forms. Submission waits for identity, serializes response writes, retains draft answers for retry, and keeps the established session through withdrawal.
• C+S journey/measurement lifecycle with generation checks, cancellation and owned-state cleanup. Parent conversions require matching configuration; denied messages ACK immediately, and managed pages permit only GA4/Meta. Withdrawal also removes Surface-owned commands queued behind slow vendor loads.
• Memory-only open-trigger caching, all embed creation paths registered before navigation, multiple-inline-frame lookup fix, duplicate-bundle runtime reuse, a three-category/multiple-form/HTML-form QA harness, rollout documentation and regenerated CDN bundles.

Validation

• pnpm typecheck passed.
• pnpm test passed: 48 tests in 11 files, including 216 expected policy outcomes executed from the pinned Forms source, actual SDK bridge interoperability and a bundled-IIFE smoke test.
• pnpm test:unit passed: 6 journey tests. The previous node journey cases were migrated into Vitest so CI runs them.
• pnpm build, git diff --check, and cmp surface_tag.js surface_embed_v1.js passed.

Draft / release gates

Automated tests use mocked network and jsdom; Forms/Paddle staging browser and saved-response QA remains pending. No production forms, CMP settings or submissions were changed.

Before release, follow docs/cookie-consent.md: verify the consent matrix, withdrawal races, saved metadata, booking/routing/CRM flows and capability recovery against the actual Forms deployment. Site-id-only pages intentionally have no optional host tracking; mixed SDK/tag instances lack a shared Forms policy registry. Direct iframe URLs must start clean, and in-frame self-navigation needs a new registration/authenticated form-ID handshake. Previously queued Dreamdata jobs and already-sent events cannot be recalled by the host tag alone. Separate legacy/standalone tracking assets remain outside this bundle.