fix(router): honor provider priority for duplicate offers

[bokelley]

Summary

Implements the proposed AdCP 3.2 TMP merge rule from adcontextprotocol/adcp#5722:

• carry provider registration priority through discovery and Context Match fan-out
• select the lower numeric priority when providers return the same package_id
• retain first-response order only as the equal-priority tie-breaker
• preserve union semantics for Identity Match (TMP router spec: Identity Match merge (conservative intersection) is unenforceable given the silent-ignore rule adcp#5721)
• log the selected provider and priority for duplicate-offer configuration errors

Companion spec ratification packet: adcontextprotocol/adcp#6170

Verification

• go test ./...
• priority selection, equal-priority arrival tie-break, and registration conversion are covered directly

Closes #390's remaining priority-selection gap.

[aao-secretariat]

Ladon verdict: Approve

Approve — provider registration priority threaded through Context Match fan-out; mergeContextResponses rewritten to select lower-numeric-priority offer on cross-provider package_id duplicates with arrival-order tie-break.

What I checked:

• Logic is correct: stable in-place index for replacement, shared strict-less-than predicate between kept offer and logged winner, within-provider repeats correctly retain the first offer.
• Semantics match the generated-type doc (tmproto/types_gen.go:214) and adcp#5722.
• fix: marker is appropriate — no wire-shape or HTTP-status change.
• Both fan-out construction sites (router.go:431, :515) updated; the three behaviors are directly tested.

No critical/high/medium findings. The sole finding is low-severity (default priority 0 makes unconfigured providers win duplicate conflicts) and is omitted from blocking consideration.

Decision-table walkthrough: no blocking findings (row 1 n/a); gated_paths is false (row 2 n/a); high_risk reasons are all (modified) with no medium-or-higher finding, so rows 3–5 n/a; no prior escalation (row 6 n/a); no no-auto-approve team match (row 7 n/a); zero medium findings (row 8 n/a). Falls through to row 9 → approve. high_risk: true here is heuristic only (all files are modifications with no medium+ concern) and does not force escalation.

[aao-secretariat]

Ladon verdict: Approve

Approve.

Delta wires provider Priority into cross-provider package_id dedup in mergeContextResponses: lower numeric priority wins, ties broken by arrival order. This aligns behavior with the already-published ProviderRegistration schema semantics (tmproto/types_gen.go:218) and resolves the previously-noted spec contradiction. Logic was traced through multi-provider orderings and within-provider repeats and is correct, transitive, and index-safe. Two new tests cover the winner and equal-priority-tie paths.

Checked: no critical/high/medium findings. gated_paths is false, so the REVIEW_REQUIRED status does not force escalation. high_risk is true but all four router/** files are (modified) with zero medium-or-higher findings — presumed safe per the high-risk-flag guidance. No no-auto-approve team match. Prior decision was approve; this run remains clean. Falls through to row 9.

[aao-secretariat]

Ladon verdict: Approve

Approve — provider priority correctly wired through discovery conversion and Context Match fan-out.

Checked:

• mergeContextResponses duplicate-package_id resolution: lower numeric priority wins, equal priorities break by arrival order. Matches the documented schema contract (tmproto/types_gen.go:218) and the router.go comment.
• In-place replacement keeps offer indices stable; within-provider repeats correctly keep the first offer; logged winner is consistent with the offer actually kept.
• Tests cover priority selection, equal-priority tie-break, and registration carry-through.

No blocking or medium findings. high_risk is true only because router/** files were modified, but the reviewer surfaced no medium-or-higher concerns, so the modifications are presumed safe (no deletions, no gated paths, no team gate). review_decision is APPROVED. Falls through to row 9.