test: pin cached form attribution boundary

[Atroci]

Problem

When a cache treats /?gclid=A and / as the same object, visitor-specific query data can leak through server-rendered form markup. A later visitor must not acquire Visitor A's campaign data from a cached form action.

Related coverage: WP Super Cache #855, WP Super Cache PR #1104, ClickTrail JS PR #20, and ClickTrail PSR middleware PR #3.

Approach

Run the shipped attribution browser script with a clean current URL and stale /?gclid=visitor-a form action. Assert the current visitor receives no gclid and ClickTrail does not treat or rewrite the form action as attribution input. Document the cache-key, request, and browser-capture boundary beside form integration guidance.

Affected Surfaces

• Frontend runtime test coverage
• Form integrations
• Docs

Screenshots

N/A. No UI change.

Compatibility / Migration Notes

No runtime or migration change. This PR pins existing behavior.

Tests / Checks Run

• npm run smoke: passed, including the Visitor B cached-form-action scenario
• git diff --check: passed

Docs Updated

• docs/reference/INTEGRATIONS.md: cache and visitor ownership boundary

Changelog / Readme Impact

No changelog or product README update. Public behavior is unchanged.