fix(cache): strip the tracking params that were still fragmenting the key

[JonasJesus42]

Found by running parity cache-gap
for real against a production worker.

UTM_PARAMS predates GA4 and the current Google Ads click ids, so a large share
of paid traffic still mints its own edge cache entry on arrival — every one of
those landings pays a full cold render.

Evidence

Probed against routes whose bare URL was confirmed warm in the same instant
(paired measurement, so colo drift cannot be mistaken for a key leak):

param	result	already on the list?
utm_source, gclid, srsltid	HIT 100%	yes
gad_source, gbraid, wbraid	MISS 3/3	no
_gl, igshid, mkt_tok	MISS 3/3	no

Deterministic, on every route probed.

What's added

• GA4 campaign params — utm_id, utm_source_platform, utm_creative_format,
  utm_marketing_tactic. Only the five classic utm_* were covered.
• Google Ads — gad_source, gad_campaignid, gbraid, wbraid. gbraid and
  wbraid are what Google sends instead of gclid on privacy-restricted traffic
  (iOS/Safari), and gad_source rides along on essentially every Google Ads click.
  Between them that is a large slice of paid landings arriving cold.
• _gl — the GA cross-domain linker. Sites already strip this by hand in client
  code, which is the tell that it turns up in real URLs.
• igshid (Instagram), epik (Pinterest), mkt_tok (Marketo), yclid (Yandex).

Why this is safe

The risk of a strip list is stripping something functional — that serves one
listing under another's key, which is worse than a miss. Every param added here is
attribution-only: none is read by a loader, and none changes what the page
resolves to.

The tests assert both directions: the new params are stripped, and page,
order, map, PS, filter.*, skuId, q still are not.

Note skuId is deliberately absent. It fragments the key and that is correct —
verified on a real PDP that the rendered HTML differs by SKU (preload image,
og:image, og:url, and the robots meta all change). Stripping it to improve a
hit rate would serve the wrong variant.

Tests

packages/blocks: 1639 passing, tsc --noEmit clean, biome clean.

🤖 Generated with Claude Code

---

Summary by cubic

Strips additional tracking parameters from the edge cache key so paid traffic hits the warm cache instead of paying a full cold render. The old list only covered the five classic utm_* params and gclid; GA4 campaign params and Google Ads click ids like gad_source, gbraid, and wbraid still fragmented the key, measured at 3/3 misses on a production storefront.

What's added

• GA4 campaign params (utm_id, utm_source_platform, utm_creative_format, utm_marketing_tactic).
• Google Ads (gad_source, gad_campaignid, gbraid, wbraid), _gl, igshid, epik, mkt_tok, and yclid.
• Tests assert the new params are stripped and functional params (page, order, map, PS, filter.*, skuId, q) are not.

^{Written for commit d38955b. Summary will update on new commits.}

[github-actions]

🎉 This PR is included in version 7.62.4 🎉

The release is available on:

• blocks-v7.62.4
• GitHub release

Your semantic-release bot 📦🚀