C-328: the full-response header set leaves out the nine client-managed fields on every lane

[O6lvl4]

C-328's p3 clause (als#133) promised that the full-response family reads the same lowercased header set on native and the stock WASI 0.3 component. That stopped holding on the host CI pins: wasmtime 49 withholds the client-managed fields from a response's fields, so connection (and keep-alive, …) vanish on p3 while native still shows them. almide/almide#3633 went red on exactly this (keys=content-length,… on p3 against keys=connection,content-length,… on native, CI wasmtime 49.0.1; locally wasmtime 47.0.2 passes them through, which is why it passed locally).

The amendment

On every lane the header set leaves out the nine fields C-370 already names as client-managed (connection, keep-alive, proxy-authenticate, proxy-authorization, proxy-connection, transfer-encoding, upgrade, host, http2-settings — wasmtime-wasi-http's DEFAULT_FORBIDDEN_HEADERS, identical in 47.0.2 and 49.0.1). get_header, header_values and headers never answer them.

This narrows what native exposes rather than loosening the comparison: the alternative, excluding them from the comparison only, would leave a program that reads connection seeing it on native and not on p3.

Implementation (almide/almide#3633, after this merges and the pin advances)

• native: request_response in crates/almide-rt-core/src/http_client_core.rs drops the names in HTTP_FORBIDDEN_HEADERS;
• p3 shim: the response prefix skips an entry whose name the existing header check classes as managed — the same table, laid out from the same constant, so wasmtime 47 (which passes them through) reads the same as 49;
• tests/http_response_cross_test.rs now pins native's set without them and adds Keep-Alive to the reply; it passes against wasmtime 49.0.1 and 47.0.2.

Gates (local, all exit 0)

check-contracts, check-contract-provenance, check-als-element-coverage, check-als-style, check-als-validation, check-links, check-gate-verification, check-ratchet-separation --staged, selftest-conformance, check-runner-coverage; README / conformance regenerated (no change).

🤖 Generated with Claude Code

Replaces #135, rebuilt on main after #134 merged (the merge queue needs gates on the new base; no force-push).