feat: add bounded v2 capability gateway transport

[neonwatty]

Adds bounded V2 issuance transport at the exact /v2/submission-capabilities path while preserving V1 isolation. The gateway forwards the frozen intent bytes and MAC through the existing binding, enforces protocol headers, strict JSON lexical/shape checks, 32 KiB requests, 64 KiB responses, visible-header budgets, and one shared eight-second deadline. It strips non-allowlisted headers and rejects redirects, cookies, and content encoding without retrying or fabricating confirmation.

Only the gateway source and its tests change. Issuer credential/MAC authentication and semantic validation, SDK confirmation verification, resources, configuration, and activation remain separate gates. The gateway returns only Content-Type and Cache-Control; local workerd tests demonstrate platform-generated Content-Length. Hidden wire duplicates and deployed edge headers/routes remain unqualified.

Validation:

• npm run validate: lint, formatting, type checks, and all 2,354 tests across 146 files passed.
• Focused gateway suites: 163 tests across five files passed, including actual Miniflare/workerd binding transport.
• Strongest failure check: an upload consumes four seconds and the issuer returns at nine seconds; the gateway returns 502 at the shared eight-second deadline, cancels the late body, and dispatches exactly once. Mixed protocol, missing/coalesced MAC, oversized bodies, and duplicate JSON keys are rejected before binding dispatch.
• Independent correctness, tests, silent-failures, contracts/types, comments/docs, and simplification reviews found no actionable issues.
• make check passed all repository gates. Native codex review --base 8db5d879dd4ecde0109a9233e4c8cdfdde1412ab found no actionable correctness defects; its nested Miniflare run encountered a local named-host DNS limitation. The parent task's complete runtime/focused/full suites passed.

Frozen inputs: SDK e26320976d337582b8bb7dafcf9839efe1010774, base 8db5d879dd4ecde0109a9233e4c8cdfdde1412ab, and approved response-header clarification v2 SHA256 8e088dc9ab74017f17b20fcb47671fd807f2717e7169821c31faab4762466711.

No deployment, route activation, credential/provider operation, or end-to-end issuance qualification is included. HTTP 200 transport is not proof of minting or confirmed acceptance. P5/P6 and deployed P10 qualification remain gated.