feat(httpclient): close the platform review's P0/P1/P2 findings

The review found one defect shape repeated across the platform: surfaces
that were declared, bound, and documented, but that nothing read. An
operator configuring fullUrlRecording, bodyLogging, retry.policy,
validatedDnsPinning, timeout.dns, or any of ten declared metric names got a
guarantee the code never delivered. Every such surface is now in exactly one
of three states -- wired for real, rejected at startup, or registered in a
test-enforced gap list with its reason. No silent no-ops remain.

P0:
- Activate the platform from bootstrap behind app.httpclient.enabled, with a
  single auto-configuration importing the nine child configurations.
- Give the platform a strict, repository-level ENV contract: 74 leaf fields
  derived from the settings record tree, unknown APP_HTTPCLIENT_* rejected.
- Route typed HTTP service clients through the call kernel via
  KernelHttpExchangeAdapter, so they stop bypassing platform policy.
- Pin dynamic-target DNS resolution to the socket for the life of a call,
  closing the resolve-then-connect TOCTOU / rebinding window.
- Actually transmit the idempotency key, and make retry eligibility depend on
  transmission rather than on merely holding one.
- Reject reactive authentication and reactive redirect at startup instead of
  declaring support that does not function.
- Fix the Reactor-only Stable contract row so the lane stops failing.
- Stop advertising HTTP/3 on a transport that negotiates HTTP/1.

P1 covers execution and retry accounting, redirect security (per-hop target
guarding, sensitive-header stripping, 303 body handling), runtime rotation
and transport resource ownership keyed by generation, dynamic-target
hardening (subdomain matching, global-unicast classification, strict CIDR
parsing), protocol intent, pool and timeout wiring, streaming and body
limits, observability parity, and OAuth single-flight refresh on a bounded
pool with a bounded wait.

P2 covers configuration and documentation drift, the Gradle check wiring for
the four hermetic lanes, and the CI gate matrix.

Two test-quality defects surfaced while closing these: the HTTP/2 stream
saturation test ran against cleartext HTTP/1.1 while asserting nothing about
the protocol, and an OAuth contention test slept on a latch that could fire
before the callers it meant to observe. Both now assert what their names
claim.

Verification run: :adapter:outbound:httpclient:check and :app-bootstrap:check
(checkstyle, spotless, spotbugs, and the four hermetic lanes),
verifyCleanArchitectureDependencies, verifyEnvKeys, verifyOneTypePerFile,
verifyDependencyLocks, the documentation and gate-matrix verifiers, and the
performance lane against a real TLS+ALPN HTTP/2 server.

Not executed, and tracked rather than claimed: Docker/Toxiproxy fault
injection, JMH, a real QUIC/HTTP3 server, a real Spring Framework 6.2
distribution (now a delegated-pending gate), live OAuth/TLS/proxy/DNS
integration, and a whole-repository check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/ci-gate-matrix.yml

@@ -24,6 +24,13 @@ gates:
     workflow: ci-quality-gates.yml
     job: quality-gates
     execution: check
+  - id: conditional-transport-qualification
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: conditionalTransportQualification
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: explicit
   - id: clean-architecture-dependencies
     release_blocking: true
     mechanism: gradle-custom-task
@@ -101,12 +108,12 @@ gates:
     workflow: ci-quality-gates.yml
     job: gate-matrix-lint
     execution: job
-  - id: redis-standalone
+  - id: redis-sdk
     release_blocking: true
     mechanism: workflow-job
-    ref: redis-standalone
+    ref: redis-sdk
     workflow: ci-quality-gates.yml
-    job: redis-standalone
+    job: redis-sdk
     execution: job
   - id: jpa-candidate-evidence
     release_blocking: true
@@ -171,7 +178,7 @@ gates:
     workflow: object-storage-qualification.yml
     job: minio-managed-contract
     execution: explicit
-  - id: poster-image-v7-migration
+  - id: poster-image-migration
     release_blocking: true
     mechanism: gradle-custom-task
     ref: posterImageMigrationTest
@@ -192,3 +199,91 @@ gates:
     workflow: object-storage-qualification.yml
     job: aws-managed-common-subset
     execution: job
+  - id: redis-sdk-support-matrix
+    release_blocking: true
+    mechanism: contract-test
+    ref: adapter/outbound/cache-redis/src/test/java/dev/caskeleton/adapter/outbound/cache/redis/sdk/RedisSupportMatrixTest.java
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  # Promoted from delegated-pending: the workflow is no longer manual-only. A pull request that
+  # touches the Redis leaf runs the standalone lane, and the full supported-version x topology
+  # matrix runs nightly and on a release candidate. While it was dispatch-only, a release could
+  # claim topology evidence that nobody had produced for that commit.
+  - id: redis-sdk-topology-evidence
+    release_blocking: conditional
+    mechanism: workflow-job
+    ref: topology-evidence
+    workflow: redis-sdk-topology.yml
+    job: topology-evidence
+    execution: job
+  - id: httpclient-stable-contract
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: httpClientStableContractTest
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit
+  - id: httpclient-security-suite
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: httpClientSecurityTest
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit
+  - id: httpclient-fault-injection
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: httpClientFailureInjectionTest
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit
+  - id: httpclient-performance-certification
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: httpClientPerformanceTest
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit
+  - id: httpclient-spring62-api-surface
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: spring62ApiSurfaceScan
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit
+  # The 6.2 API-surface scan above proves the common packages compile against the older surface. It
+  # does not prove they run on it, and the two were being conflated: a lane called
+  # "spring62CompatibilityTest" reads as a runtime compatibility proof. The Gradle task is renamed to
+  # say what it does, and the runtime claim is registered here as its own delegated-pending control
+  # so the gap is a tracked absence rather than an unstated one. Executing it needs a Spring
+  # Framework 6.2 distribution resolved into a separate test runtime, which this repository's
+  # Boot 4.0 baseline does not carry.
+  - id: httpclient-spring62-runtime
+    release_blocking: conditional
+    mechanism: delegated-pending
+    ref: spring62-runtime-lane
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: job
+  - id: httpclient-spring70-compatibility
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: spring70CompatibilityTest
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit
+  - id: httpclient-documentation-drift
+    release_blocking: true
+    mechanism: workflow-job
+    ref: httpclient-documentation
+    workflow: httpclient-release.yml
+    job: httpclient-documentation
+    execution: job
+  - id: httpclient-event-loop-blocking
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: httpClientBlockHoundTest
+    workflow: httpclient-release.yml
+    job: release-gate
+    execution: explicit