fix: break the TechLog CSRF bootstrap cycle and close the review's fix-round-1 items

C1 (Critical): getStudioSession was stamped with the same
TECH_LOG_STUDIO_SESSION auth profile as every other Studio operation, and
that profile requires the CSRF header it is getStudioSession's own job to
issue -- an unconditional cycle that recursed without bound in HTTP mode.
Fixed with a credential-free TECH_LOG_STUDIO_BOOTSTRAP auth profile for
getStudioSession alone, a synchronous re-entrancy guard in
createCsrfTokenProvider as defense in depth, and a throwing stub in place of
the prior `let x!: T` assertion. Added a composition-level regression test
that wires the real executor, CSRF provider, and credential-attach function
together and proves getStudioSession dispatches exactly once while its token
reaches both a JSON operation and the multipart upload.

Also: invalidate the cached CSRF token on a 401/403 from the upload path
(I2), a throwing useStudioAssetGateway() accessor so Task 11 cannot silently
compile a null-gateway UI (I3), and the M1-M5 minors from the review (guard
a malformed success body, cover the untested error fallbacks, align aborted
uploads with the JSON path's non-retryable CANCELLED mapping, derive the
credential header name from one source instead of two, and correct the
adapter review doc's operation count).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/runtime-schema/http-schema.test.ts

@@ -85,4 +85,15 @@ describe("REST auth profile registry", () => {
       "x-csrf-token",
     ]);
   });
+
+  it("installs a credential-header-free bootstrap profile for getStudioSession", () => {
+    const profile = INSTALLED_REST_AUTH_PROFILES.get(
+      "TECH_LOG_STUDIO_BOOTSTRAP",
+    );
+    expect(profile).toBeTruthy();
+    expect(profile?.transport).toBe("SAME_ORIGIN_COOKIE");
+    expect(profile?.credentials).toBe("include");
+    expect([...(profile?.requiredCredentialHeaders ?? [])]).toEqual([]);
+    expect([...(profile?.allowedCredentialHeaders ?? [])]).toEqual([]);
+  });
 });