C-367: compare http.serve by status code, header set and de-framed body, not raw bytes

[O6lvl4]

The response half of ADR-0020 §7.1 (almide/almide#2695), which almide/almide#2700 (ADR-0020 step 6) needs before its replay driver can compare HTTP semantics instead of bytes.

What changes in C-367 (statement, title, ALS-R5 prose, the fixture's header comment):

• Each request is answered with the same status code, header set and body on both legs, in place of a byte-identical status line, headers and body.
• The header set is the response's fields as (name, value) pairs:
  • names compare ASCII-case-insensitively;
  • fields with different names are unordered;
  • fields with the same name keep their relative order (RFC 9110 §5.3).
• The host-managed fields date, connection, keep-alive, transfer-encoding and content-length are excluded. The body is compared de-framed.
• The reason phrase is not part of the contract. 418 OK natively and 418 I'm a teapot under hyper, measured by the http.serve on stock wasm artifacts: a build --target wasm shape for the server (wasi:sockets p3 or an incoming-handler export) almide#2659 prototype.
• The stderr transcripts hold the same lines. Their order across requests is not promised.
• NOT covered gains "HTTP framing and connection reuse (the host's)".

What does not change: the one-instance, sequential, accept-order semantics and the /boot capture, the request readers, the handler-err 500, the bind abort, and the stdout rule. The rest of §7.1 lands with the ADR steps that make it true:

• per-instance app evaluation: step 2;
• concurrency: step 4;
• the wasi:http export host: step 7.

This PR does not describe any of them yet.

ALS-R5 re-stamped (proofs/als-validation.toml); README regenerated. Local gates: check-contracts, provenance, element coverage, style, validation, links, gate-verification, and the conformance self-test all pass.