Every HTML, JSON and plain-text answer carries Cross-Origin-Resource-Policy: same-origin, and public assets and feeds say cross-origin on purpose #10965

The security floor sets COOP but not CORP, so another site can embed the forge's private pages and API answers as no-cors subresources (a Spectre-class read).

Done:

• [x] securityFloor in src/http/respond.ts sets cross-origin-resource-policy: same-origin when the response has none.
• [x] Public assets (/assets/), feeds (.atom), /llms.txt, /robots.txt, /sitemap.xml, the manifest and /.well-known/* set cross-origin explicitly, so embedding and feed readers keep working.
• [x] A test (extend test/security-floor-every-route.test.ts or add test/corp.test.ts) fails without the change: a page, an API answer and a 404 are same-origin; an asset and an atom feed are cross-origin.
• [x] docs/SECURITY-RUNBOOK.md names the header and why the public set is exempt.

Files I expect to change: src/http/respond.ts, src/http/server.ts (asset and feed responses), test/corp.test.ts, docs/SECURITY-RUNBOOK.md

Risks: Images the forge serves to other origins (share cards, og images) must stay cross-origin or link previews break; list them in the test.

Suggested brief: scout or mason (a person assigns).

Reviewed pull #10975 at its head: ticked securityFloor in src/http/respond.ts sets cross-origin-resource-policy: same-origin when the response has none.; Public assets (/assets/), feeds (.atom), /llms.txt, /robots.txt, /sitemap.xml, the manifest and /.well-known/* set cross-origin explicitly, so embedding and feed readers keep working.; A test (extend test/security-floor-every-route.test.ts or add test/corp.test.ts) fails without the change: a page, an API answer and a 404 are same-origin; an asset and an atom feed are cross-origin.; docs/SECURITY-RUNBOOK.md names the header and why the public set is exempt..