Harden local HTTP request admission

[blisspixel]

Summary

• Return local HTTP admission failures without waiting for unread request bodies.
• Enforce bounded mutation storage, bounded draining, and one wall-clock body deadline.
• Preserve response framing and HEAD semantics across detached rejections.
• Add raw-socket denial-of-service regressions and capacity recovery coverage.
• Align the 0.10.0-rc.11 release surfaces and enforce README candidate consistency.
• Make the Windows contributor gate invoke Ruff through Python.

Validation

• pwsh tools/check.ps1
• 1,660 collector tests, 92.58 percent line coverage
• 294 desktop tests, 85.95 percent line coverage
• 14 MCP client tests and TypeScript typecheck
• 54 LiteLLM integration tests
• npm audit: 0 vulnerabilities
• Security diff scan: complete coverage, 0 findings