fix(feature-flag-called-tracker): add session-attribution properties to minimal-event allowlist

[posthog]

Why

posthog-js#4287 ("keep session-attribution props on minimal $feature_flag_called events") fixed a web-analytics data-correctness bug: the minimal-event allowlist added by posthog-js#4172 (documented here in #16) stripped every referrer and campaign/click-id super property (utm_source, gclid, $referring_domain, etc.). Web-analytics session-initial UTM attribution and channel-type grouping are read from the first event in a session, and a minimized $feature_flag_called event can be that first event — so a flag call landing first in a session silently nulled out the session's whole attribution.

openspec/specs/feature-flag-called-tracker/spec.md's "Minimal event mode for non-experiment flags" requirement lists allowlist categories at a category level but never mentions referrer or campaign/UTM properties anywhere — not in the category list, the posthog-python reference literal, or the "everything else... SHALL be stripped" clause. This is a real spec gap: an SDK implementing minimal-event-mode strictly per the current text would (correctly, per the spec) strip these and reproduce the same bug.

What this PR does

• Adds a "Session-attribution properties" category to the minimal-event allowlist — $referring_domain and canonical campaign/click-id super properties (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gad_source, mc_cid, gclid/fbclid-style ids) — noting that full $referrer remains excluded (only $referring_domain and bare campaign-param keys survive), preserving the minimal event's privacy/payload-size intent.
• Adds one new @client scenario asserting session-attribution properties are retained while $referrer itself is still stripped.
• Change proposed and archived on this branch per this repo's one-PR-per-change convention (openspec/changes/archive/2026-08-05-fix-flag-called-session-attribution/).
• openspec validate --specs --strict passes (59/59).

Uncertain / flagged for reviewer attention

• Only posthog-js/posthog-node (the shared @posthog/core implementation) were confirmed to have shipped this bug and fix. No other in-scope SDK currently ships a minimal-event mode per feat(feature-flag-called-tracker): document minimal event mode for non-experiment flags #16's own audit, so this is a documentation-only correction, not a new cross-platform parity gap — flagged as a follow-up check in tasks.md §3.1 for if/when another SDK adds minimal-event mode.

---

Created with PostHog Code

[marandaneto]

@dustinbyrne should we merge this?