feat(middleware): add a hook to inspect HTTP responses - #3074

Summary

Implement HTTP response processing before delivery to the sandbox, using the merged #3073 contract. Keep the configured-literal content guard semantic across request, response, and WebSocket hooks, and move the path-driven contract demonstrations into one standalone protocol example.

Related Issue

Part of #2691. Builds on merged #3072 and #3073.

Changes

• Add the response session runtime and HTTP relay integration for header-only, whole-body, and unit-local streaming inspection, including one-byte stream limits.
• Apply per-stage mode eligibility, payload limits, fail-open/fail-closed policy, whole-body deadlines, framing normalization, trailer validation, and pre-/post-commit block behavior.
• Share literal matching outcomes across content-guard request, response, and WebSocket adapters. Response inspection requires WHOLE_BODY_BYTES; unavailable inspection returns a middleware failure. Clean bodies pass unchanged, matching bodies are redacted or blocked with content_match, and trailers pass unchanged.
• Add supervisor-middleware-protocol with request, response, and WebSocket modules, a standalone manifest and lockfile, policy, local fixture, and smoke launcher. It demonstrates request/message replacement, response headers, complete-body and streaming transforms, trailers, content-length/chunked/close-delimited framing, and deterministic pre-commit blocking.
• Update example documentation and the architecture overview, and include both examples in local and branch Rust checks and tests.
• Leave cross-unit windowed matching and spooled whole-body ownership for follow-up design.

Testing

• mise run pre-commit passes.
• cargo test --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --offline: 15 tests pass.
• cargo test --manifest-path examples/supervisor-middleware-protocol/Cargo.toml --offline: 8 tests pass.
• bash -n passes for both smoke scripts; Python fixture/client syntax checks pass.
• CONTENT_GUARD_SMOKE_DRIVER=docker bash examples/supervisor-middleware-content-guard/smoke.sh --test-suite: passes response pass-through, redaction, denial, and guarded/unguarded requests through external middleware.
• PROTOCOL_SMOKE_DRIVER=docker bash examples/supervisor-middleware-protocol/smoke.sh --test-suite: passes request, WebSocket, and all response demonstrations through external middleware.
• Full mise run test and mise run ci are not green on this branch. The runs reached failures in unchanged server JWKS tests: duplicate_kid_conflicting_algorithms_poison_pill and key_ops_verify_accepted_sign_only_rejected returned Internal instead of Unauthenticated. The latter passes in isolation. Newer main fixes the shared fixture lifetime in test(server): stabilize JWKS validation tests #3225; that unrelated change is not included here.

The first test attempt also inherited tag.gpgsign=true, breaking temporary lightweight-tag fixtures. Subsequent test/CI commands used GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=tag.gpgsign GIT_CONFIG_VALUE_0=false for the test process only. A README lint error found by CI was corrected and verified by the final pre-commit run.

Checklist

• Follows Conventional Commits.
• Commits are signed off for DCO.
• Unit and Docker smoke coverage added/updated.
• Architecture and example documentation updated.
• Full branch validation remains subject to the existing JWKS test issue above.

PR #3075 was stacked on the old #3074 history and needs realignment after this branch stabilizes.