Avoid the first-load Didomi geo redirect

[prk-Jr]

Description

With Didomi trusted geo query parameters enabled, the first geo-less notice-loader request receives a private 307 redirect to the canonical URL containing country and region. This guarantees a correct browser and cache identity, but adds an uncacheable round trip to a render-sensitive CMP script.

Design a browser bootstrap path that exposes normalized trusted geo early enough for Didomi to construct the canonical loader request on its first attempt. Keep the server-side redirect as a safety net for missing, stale, or conflicting browser parameters.

This requires coordinated changes to the Didomi head injection and browser bundle and should be designed independently from the server-side correctness work in #85.

Done when

• Valid trusted country and region can be delivered to the Didomi browser bootstrap without accepting browser-provided geo as authoritative at the server.
• Didomi normally requests the canonical loader URL on its first request.
• The server continues to replace conflicting geo and redirect non-canonical requests.
• Missing or invalid platform geo retains the documented availability behavior.
• Browser tests cover first-load behavior, custom proxy paths, and the redirect fallback.

Affected area

Integrations (Didomi), HTML processing / JS injection