feat!: contract Testing API and harden injection lifecycles

[smiggleworth]

Request injection accepted invalid redirect limits, lost responses arriving after abort, ignored abort during custom-cookie waits, and rejected documented streaming body options under Node. Custom cookie-store write failures were swallowed. Validate redirect limits before dispatch, cancel owned late responses without waiting for cleanup, observe abort throughout cookie handling, set half duplex for stream options, and propagate custom-store failures with their original identity. Only the built-in jar's policy rejections remain ignorable. An already-started application/store operation remains application-owned; the cancellation and bounded-stream limits are documented.

Reduce the root API from 18 to 11 declaration names: remove the redundant request constructor and six supporting aliases, retain three runtime helpers and eight deliberate consumer types, and publish the complete decisions/migrations with the artifact. Installed consumers enumerate the full surface, reject seven removed names and nine private paths, and compile strictly with TypeScript 6.0.2 and 7.0.2. Versions stay at 0.4.1 during coordinated 0.5 preparation.

Validation: baseline 28 cases passed; new lifecycle probes first reproduced 23 failing variants, and stream probes reproduced two further failures. PR review reproduced one swallowed store-failure case, then verified failure/recovery and retained built-in cookie rejection behavior. The final Node 24 clean-install package gate passes with 67 unit cases, existing V8 floors unchanged (99.37% statements, 89.6% branches, 100% functions/lines), publint, exact artifact files and a normal installed consumer. Runtime artifact checks cover session redirects/clear, binary stream transfer, invalid redirect configuration and custom-store failure cleanup. Compatible development updates clear the four initial audit entries; all production lock entries are unchanged.

Addresses #45 and #46. Hardening closure awaits exact PR and merge-commit checks; API #45 remains open until the complete candidate graph and website migration pass. Official publication is held for the maintainer's full review of the frozen 0.5.0 change set.