✨ Add amp-ad implementation for gsrv (#40564)

Ad zones served by an ad network that runs on GoAdserver. The vendor
script loads the network's ad controller from data-host and hands it the
zone; the controller renders it into the frame and calls renderStart()
with the ad's size, noContentAvailable() on no fill, and
reportRenderedEntityIdentifier().

🐛 Fix client hints URL parameter construction in mapp_intelligence (#…

…40523)

Consolidate separate param-name and value variables into single segment
variables that include the & separator only when the value is present,
preventing malformed &= fragments in the tracking URL when client hints
are disabled.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Shihua Zheng <powerivq@users.noreply.github.com>

📦 Update dependency esbuild to v0.28.0 (#40513)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Shihua Zheng <powerivq@users.noreply.github.com>

✨ Update Neodata amp-analytics vendor config with GDPR support and co…

…nditional cookie-match (#40520)

* feat(amp-analytics): update neodata vendor config with GDPR support and conditional cookie-match

- Add gdpr=0|1 parameter to pageview URL derived from CONSENT_METADATA(gdprApplies)
- Extract gdprAppliesFlag into vars section to keep the URL readable
- Split trackCookieMatch into three separate triggers (trackCmDbm, trackCmAdform,
  trackCmMediamath), each controlled by an enableCm* var defaulting to "" (disabled),
  so publishers opt-in to individual partners from the in-page tag
- Rename requests ADFORM→cmAdform and MEDIAMATH→cmMediamath for naming consistency
- Update vendor-requests.json fixture and analytics-vendors.amp.html example accordingly

* ci: retrigger CircleCI build

verify message source on cached sentinel in inabox host (#40519)

Co-authored-by: Shihua Zheng <powerivq@users.noreply.github.com>

🏗 Update CircleCI Orbs to latest versions (#40525)

📦 Update dependency chromedriver to v148 (#40496)

* 📦 Update dependency chromedriver to v148

* Fix tests broken by browser API changes

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Rozenberg <rodaniel@amp.dev>

Add GDPR/consent support to amp-slikeplayer (#40500)

* Add GDPR/consent support to amp-slikeplayer

Integrate AMP consent framework so the Slike player iframe can request
and receive consent data via postMessage, enabling cleo-player to handle
personalisation and analytics decisions based on user consent state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add unit tests for consent data forwarding in amp-slikeplayer

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: allow 'expanded' attribute in Purifier (#40501)

* fix: allow 'expanded' attribute in Purifier

Allow 'expanded' to be preserved during HTML sanitization. This is needed for amp-accordion (and Bento accordion) when rendered inside templates like amp-mustache, where state attributes on standard tags (like <section>) were being stripped.

Includes test case for standard elements.

* fix: allow 'expanded' attribute in Purifier

Allow 'expanded' to be preserved during HTML sanitization. This is needed for amp-accordion (and Bento accordion) when rendered inside templates like amp-mustache, where state attributes on standard tags (like <section>) were being stripped.

Includes test case for standard elements.

* remove conflict markers

* remove the allowlisting to change the test

* add back allowlist

Only run package-lock.json sync check on PRs (#40495)