#8341 fix(api): constrain workflow response headers

Summary

• Keep Response block HTTP replies as JSON regardless of custom header casing.
• Reserve cookie, browser-policy, redirect, and transport headers for the server while preserving response data, status codes, and ordinary custom headers.
• Document the header restrictions and cover the HTTP response boundary with regression tests.

Type of Change

• Bug fix

Testing

• 127 tests passed across response security, workflow utilities, and v1/v2 workflow execution routes.
• All five security regression cases failed before the fix; removing each of the four guards also failed the regression suite.
• App type-check, lint, all 51 repository audits, block-registry check, and docs-manifest check passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)