fix: own server request and response lifetimes

[smiggleworth]

Request bodies could hang on cancellation, HEAD and discarded middleware responses could retain streams, and invalid access-denial results could execute the protected handler. Own those lifetimes, reject invalid response/probe values, and propagate a failing onError callback once per request.

Retire saved middleware continuations, preserve transferred/cloned response bodies, and keep cached body failures handled. Correct benchmark fixtures that silently dispatched 404s and include benchmark sources in typechecking. Ship the hardening evidence and add coverage plus normal packed-install gates.

Validation: clean Node 24.21.0 npm ci, format check and npm run check pass: 465 unit cases, V8 floors, strict declarations, publint/artifact checks, and all nine normally installed entrypoints with native lifecycle probes. npm audit reports zero findings; ten production lock entries are unchanged. Initial regressions and subsequent review probes were demonstrated failing before their fixes.

Corrected-fixture local pairs measured JSON/form binding about 0.5-0.6 microseconds slower and two-middleware dispatch about 0.1-0.15 microseconds slower. These are measured correctness costs, with no optimization or capacity claim. Full scenarios and partial coverage are recorded in docs/0.5.0-hardening.md.

Refs #73. Keep #73 open for real Node listener/connection-cleanup qualification and the final candidate checks. API contraction #72 is separate. Version remains 0.4.1 during preparation; official publication requires the maintainer's full review of the frozen 0.5.0 candidates.