Make EC withdrawal tombstoning idempotent across request bursts

[ChristianPavilonis]

Summary

• Make existing EC withdrawal tombstones a true no-op across repeated and bursty requests.
• Preserve the first tombstone's 24-hour TTL by avoiding all backend work once authoritative tombstone state is observed.
• Keep existing-key-only privacy, CAS race handling, two-ID withdrawal, and best-effort browser response behavior intact.

This PR is stacked on #900.

Changes

File	Change
crates/trusted-server-core/src/ec/kv.rs	Return matching tombstone snapshots before KV work, remove the dead unconditional overwrite API, and add operation/race coverage
crates/trusted-server-core/src/ec/finalize.rs	Add two-present-ID, repeated withdrawal, and KV-failure cookie-deletion integration tests
docs/superpowers/plans/2026-07-13-issue-881-idempotent-withdrawal-tombstones.md	Record the reviewed concurrency semantics and verification contract

Closes

Closes #881

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve — not run
• Other: cargo test-cloudflare, cargo test-spin, cross-adapter parity, and all Cloudflare/Spin native + WASM clippy targets

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed