fix: identify M0 publisher at ingress

[Pigbibi]

Summary

• send a stable, non-sensitive M0 publisher User-Agent
• avoid Cloudflare blocking the generic Python client identifier
• document and test the request header

Verification

• Python M0 publisher, envelope, and ledger tests: 20 passed
• Strategy-switch Worker validation passed
• anonymous endpoint probe: generic Python User-Agent returns 403; QSL publisher User-Agent reaches the Worker authentication boundary

Research-only publishing transport change; no strategy, broker, runtime target, or order behavior changes.