Widen C-328 to the stock p3 component, state the p3 legs of C-330/C-366/C-367, and add C-370 header refusal

[O6lvl4]

Step 0 of almide/almide ADR-0023 (docs/adr/0023-wasm-http-over-wasi-http.md §5 and §7), for almide/almide#2659.

• C-328 gains the stock WASI 0.3 component as a third lane and one error classification: invalid-url, refused-header (C-370), dns, connect, timeout, tls, too-large and protocol, each with one text that names the URL the program passed (quoted with fixed escapes) and carries no OS errno. It also states how the p3 shim maps the wasi:http error-code cases onto the classes, and what stays unclassified: proxy failures, a trust store that does not load, and internal-error. New fixture: spec/embedded_cross/http_error_classes.almd.
• C-330: the flag surface is -S http=y (no -W, no -S p3, ADR-0023 step 1). A failure answers C-328's classified text, where it used to answer the static E_HTTP.
• C-366 / C-367: the stock p3 leg is stated as it is today. It refuses the call handle and http.serve with E081 at build time, and exports no wasi:http/handler@0.3.0 (ADR-0023 steps 4 and 8).
• C-370 (new): header refusal. A non-token name, a value with a control character, and the nine fields the client manages (wasmtime-wasi-http's forbidden set) are refused before dialling, with the same err on native, embedded and p3. New fixture: spec/embedded_cross/http_header_refusal.almd.

The implementation PR in almide/almide advances proofs/als-pin.txt to this commit and mirrors the statements byte for byte. Its tests/http_error_class_cross_test.rs runs both fixtures, plus a stalled server, a plain-TCP server under https and an oversized response, on native, embedded and wasmtime run -S http=y. Stdout, stderr and exit code are identical on all three.