fix(session): session exemption must not swallow a competing attribution param

[i8ramin]

Second of two PRs for item 3 of #52, and the precise fix. (#56 is the TTL bound; this is independent of it and can land in either order.)

The edge case

Land on merchant.com via our own CJ link (self-exempt the host), then in the same session click a competitor's CJ link back to merchant.com. Both are policyId: 'cj', so the persisted exemption dropped the competitor's match and we did not stand down. We kept a sale we should have ceded.

The fix

applySessionExemptions now keeps (does not suppress) a match that is:

• a landing-param or redirect-domain (an explicit attribution click), and
• not a self-match on the current navigation (its scope is absent from detection.selfExemptScopes).

Ambient lingering signals (cookie, initiator) are still re-attributed to us, so the documented ignore_param "our click owns this host's session" case is unchanged. This surgically removes only the competitor-hijack behavior.

Why this is the right seam

The dedicated self-exemption-scope.test.ts encodes the legitimate 'session' use as "param seen once, cookie seen later" — a cookie-kind signal. This fix deliberately preserves that and only refuses to swallow a fresh competing param. No existing test changes behavior.

Contingent on value-specific self-patterns

The fix bites only when self-patterns are value-specific (value + match), which is exactly what self-exemption.ts and ADOPTING.md already tell adopters to do. A name-only self-pattern claims every value of that param as ours, so a competitor's value looks like a self-match and is still suppressed. That is the same name-only footgun the docs already warn about, so behavior there is unchanged and consistent.

Behavior-change note (the sign-off you approved)

In the "merchant re-decorates the URL with a real, non-ours affiliate param later in the session" case, we now stand down instead of keeping the sale. That is the honest outcome (a real competing attribution is present), and it is the deliberate change flagged in the #52 write-up.

Tests

• New: a competing same-network click (different value) on an exempted host stands down. Verified it fails without the change (suppressed) and passes with it.
• New: our own value keeps re-exempting (no over-correction), and the lingering cookie stays attributed to us.
• All existing exemption-scope tests unchanged.

Full suite green (165 tests, +2), typecheck / lint / citations / build clean.