feat(network): inspect HTTP responses before return

[pimlock]

Summary

Add the runtime and HTTP relay integration for response pre-return middleware. This PR reuses the existing content-guard example instead of adding a second middleware example.

Stacked on #3073, which defines the protobuf and transport interface. #3073 is stacked on #3072, which centralizes and broadens HTTP header mutation authority.

Related Issue

Part of #2691

Changes

• add the response middleware session runtime for headers-only, whole-body, and streaming inspection
• enforce response middleware before returning upstream HTTP responses to the sandbox
• define fail-open, fail-closed, timeout, framing, trailer, and post-commit delivery behavior
• extend supervisor-middleware-content-guard with response modes and a local upstream fixture
• include the existing example in branch checks and local Rust tasks

Testing

• mise run pre-commit
• mise exec -- cargo test -p openshell-supervisor-middleware (102 passed)
• mise exec -- cargo test -p openshell-supervisor-network -- --test-threads=1 (1,287 passed, 7 ignored)
• mise exec -- cargo test --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml (17 passed)
• raw upstream smoke coverage for content-length, chunked, and close-delimited responses

Checklist

• Tests cover the new runtime and relay behavior
• Existing example demonstrates the response contract
• Documentation is isolated in the follow-up stacked PR
• Commits are signed off for DCO

Stack

1. feat(middleware): broaden HTTP header mutation authority #3072 — shared header mutation authority
2. feat(middleware): define HTTP response pre-return interface #3073 — response protobuf and transport interface
3. feat(network): inspect HTTP responses before return #3074 — response runtime, relay integration, and existing example
4. docs(middleware): document response pre-return workflow #3075 — documentation and middleware guide reorganization

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.