Add the permission model with the Privacy Taxonomy vocabulary

[jwrosewell]

Third of five stacked PRs decomposing #838 as requested in the #986 review. Stacks on #1044. Compare split/3-permissions to split/2-device-geo to see only this PR's change.

Spec: docs/superpowers/specs/2026-07-30-permission-model-design.md, the Tech Lab 2026-07-31 draft revised to match this implementation, with a revision-record table listing every divergence and why. Reader-facing documentation lands with it at docs/guide/permission-model.md.

What this PR does

Permissions become the primitive that gates identity features, and consent is one of several ways a permission is established (a country baseline, an opt-out signal, and configuration are others).

• permissions.rs resolves a per-request permission state from the country and region baseline in permissions.yaml, augmented by the session's signals (TCF, GPP, GPC, US Privacy). Permission names follow the IAB Privacy Taxonomy Data Uses.
• Signal precedence is fixed in code, most restrictive first. A US-style opt-out suppresses the Data Uses the policy revokes even when a TCF record consents, because an explicit opt-out is never overridden by another signal. A consent record that is present but cannot be decoded blocks baseline grants (fail-closed) instead of degrading to the no-signal baseline. Only then does a TCF record decide its mapped Data Uses. Pinning tests cover each opt-out source against a consenting TCF record.
• Destructive withdrawal is narrow. Only a TCF record refusing storage in a jurisdiction whose baseline did not grant it expires the cookie and writes the identity-graph tombstone. Opt-outs suppress use (headers stripped, nothing egressed) but never destroy an issued identifier, so lifting the opt-out restores the identity.
• Sharing beyond the edge (bidstream user.id, the identify response, partner pull-sync) requires storage plus personalised-ad selection, the same pair that gates bidstream EIDs, so a storage-only grant keeps first-party use while withholding partner sharing.
• The Edge Cookie gate moves from raw consent to the permission model. A provider declares required_permissions() and core executes it only when every one is set.
• [geo] default_country becomes required and is validated against permissions.yaml at startup, so there is always a defined permission baseline. A failed geo lookup is distinct from an unmatched country. It resolves at the requires-signal floor instead of the deployer default and is logged at error level. Geolocation is now off by default, and a deployment that runs an Edge Cookie provider with no geo provider must set [geo] assume_single_jurisdiction = true, acknowledging that every request is treated as the default jurisdiction.
• permissions.yaml rules use an explicit per-permission acquisition map (granted, requires_signal, denied). Unknown keys in a rule and duplicate rule keys differing only by case are rejected at parse. An EU-27 plus EEA coverage test locks the gdpr-eu mapping.

How it was verified

Full local gate on this branch, all clean, including the reinstated opt-out precedence pinning tests and per-trigger withdrawal units. cargo test-fastly, cargo test-axum, cargo test-cloudflare, cargo test-spin, the integration parity suite, cargo fmt --check, and all six per-target clippy aliases.

Framing

Privacy is a spectrum and technology is neutral. This model encodes no jurisdiction's law. The deployer brings the policy in permissions.yaml and configuration, decides their own baselines, and the code makes those decisions inspectable and enforced. Trust comes from that flexibility being respected, not from constraint.

References #778. Decomposes #838. Spec baseline from #986.

Produced with AI assistance under James Rosewell's direction, and flagged here so reviewers know to apply the usual scrutiny.