Sync request-path and TLS correctness fixes

[faratech]

Summary

• sync the sanitized implementation from internal commits a4f7696 and ab3318b
• reduce H2 and bridged-request hot-path overhead
• preserve configuration-safe CGI fail-closed routing while skipping unused scans
• preserve monoio-rustls read-ahead across the handshake transition
• keep public-owned README and CI/fuzz/interoperability workflows unchanged
• exclude private benchmark and PGO operational scripts

Validation

• internal full workspace tests passed
• optional kTLS and OTel builds passed
• coalesced Finished plus 64 KiB POST regression passed
• public export reproducibility, credential-pattern, and dependency-license checks passed
• public cargo fmt --all --check, cargo metadata --no-deps, and git diff --check passed
• hardened PHP suite completed 8/8 rows with 1,200 exact 2xx responses each
• controlled TLS loop: current production binary 16/256 bad-record-MAC failures; candidate 0/256

Performance

All median non-inferiority gates passed versus the current production binary:

• PHP H1 GET: -0.238% throughput, +1.102% task time per request
• PHP H2 POST64K: -1.522% throughput, +0.289% task time per request
• H2 static1K: +26.251% throughput, -0.791% task time per request

Production was not changed or restarted.