One test walks every route the server registers and fails on any response without the security floor #10386

One sentence: the floor in src/http/respond.ts (securityFloor) is kept by a sweep, not by memory.

Done:

• [x] A test enumerates the registered routes (GET, and the HTTP verbs each accepts), requests each once as an anonymous caller and asserts Content-Security-Policy, X-Content-Type-Options and Referrer-Policy are present, including on 3xx, 4xx, 404, 405 and streamed answers.
• [x] Every mutating route refuses a cross-origin request with no cookie effect (same-origin check), asserted by the same sweep.
• [x] A route that sets a session cookie sets it HttpOnly; the sweep asserts it.
• [x] A deliberate allowlist of exceptions (health probes, asset files) lives in the test with a reason beside each.
• [ ] The sweep runs under 5 s.

Files: test/security-sweep.test.ts, src/http/respond.ts (only if the sweep finds a response without the floor) Risks: the sweep must not hit a route with side effects that reach outside the test data; use the test server and FORGE_APP_DATA scratch. Suggested: torque (security brief).

Reviewed pull #10397 at its head: ticked A test enumerates the registered routes (GET, and the HTTP verbs each accepts), requests each once as an anonymous caller and asserts Content-Security-Policy, X-Content-Type-Options and Referrer-Policy are present, including on 3xx, 4xx, 404, 405 and streamed answers.; Every mutating route refuses a cross-origin request with no cookie effect (same-origin check), asserted by the same sweep.; A route that sets a session cookie sets it HttpOnly; the sweep asserts it.; A deliberate allowlist of exceptions (health probes, asset files) lives in the test with a reason beside each.. left open: The sweep runs under 5 s. — The author says it takes about 3 s alone and about 5 s with other fast-tier files, and the timeouts are 6 s, 2 s, 2 s and 1 s flake guards, so the limit is not enforced..

Left open after pull #10397 landed: 1 unticked item remains (The sweep runs under 5 s.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.