Restore tracker mapping linking, drop only create

The tracker-mapping worker had been reduced to catalog resolution only,
which removed not just the auto-creation of an org ThirdParty but also
the auto-linking of an existing one. Only the creation needed to go: it
raced the load-then-create check and produced duplicate vendors.

Restore the full org ThirdParty resolution (exact common-id link,
sibling direct-link, high-confidence heuristic, and the disambiguation
agent) and remove only the CreateFromCommon branch and its
categorisation gate. When nothing matches, the worker now leaves
third_party_id unset rather than creating a vendor; creation happens
exclusively through the explicit ImportFromCommon action. Drop the
now-dead CreateFromCommon helper and rename match.go to common_match.go.

Fix a latent test bug surfaced by actually running the DB-backed suite
(skipped in CI without Postgres): the heuristic-match candidate lacked
Level 1, so the level-filtered candidate loader excluded it and the old
fallback create masked the miss.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/service.go

@@ -2284,9 +2284,8 @@ func (s *Service) reportDetectedTracker(
 
 			// A stronger source can unblock mapping: the detection
 			// upserted below carries a fresh initiator domain that
-			// matchByDomain/matchBySiblingOrigin can now use, and an
-			// EXTENSION->SCRIPT promotion lifts the creationAllowed
-			// gate. Re-arm mapping so the worker revisits the pattern.
+			// matchByDomain/matchBySiblingOrigin can now use. Re-arm
+			// mapping so the worker revisits the pattern.
 			if err := matchedPattern.SetMappingRequested(ctx, tx); err != nil {
 				return fmt.Errorf("cannot request mapping after source promotion on tracker pattern %q: %w", matchedPattern.Pattern, err)
 			}