Cache-Control 'no-store, max-age=31536000' for #[Cacheable] + #[HttpCache(noStore: true)] #243

A #[Cacheable] resource that declares #[HttpCache(noStore: true)] is served with a self-contradictory Cache-Control header:

Cache-Control: no-store, max-age=31536000

Reproduction

#[Cacheable, HttpCache(noStore: true)]
class AttributeNoStore extends ResourceObject
{
    public function onGet(): static
    {
        $this->body = ['n' => 1];

        return $this;
    }
}

Two GETs of app://self/attribute-no-store, observed on the 1.18.0 candidate (#242, 351df09):

1st cc="no-store, max-age=31536000"   2nd served from the store (onGet ran once)

On tag 1.17.0, a #[Cacheable] resource that sets no-store in its $headers property default produced the same no-store, max-age=31536000. The max-age is appended after the resource's own no-store.

Expected

QR stores the declared case server-side on purpose: the attribute is a client-facing directive. The header sent to the client should still not combine no-store with a one-year max-age. no-store should stand alone, or max-age should not be appended when no-store is present.

no-store wins for a client per RFC 9111, so this is a correctness and clarity issue rather than a leak. A downstream shared cache that only reads Cache-Control sees conflicting directives.

Not addressed in #242.