Every forge response denies interest-cohort too, and forge-webspec sees the security floor production sends #3130

Replaces #3089, which was parked twice. Both pulls (#3099, #3122) failed the type check on one line, test/forge-webspec.test.ts(11,10): error TS2300: Duplicate identifier 'securityFloor': the builder imported it twice. The header work itself was right.

What is already true on main: securityFloor in src/http/respond.ts sets permissions-policy (camera, microphone, geolocation, payment, usb, serial, hid, bluetooth) on every response. src/http/server.ts applies it outside forgeHttp(app).handle. That is why forge-webspec, which calls handle directly, sees no header.

Done looks like:

• [ ] PERMISSIONS_POLICY in src/http/respond.ts also denies interest-cohort=(). Nothing else in the floor changes. App-proxy responses are untouched, and WebAuthn (passkeys) is not denied.
• [ ] In test/forge-webspec.test.ts, the fetcher passes each response through securityFloor, the way production does: (input, init) => http.handle(new Request(input, init)).then(securityFloor). securityFloor is imported once, from ../src/http/respond.ts.
• [ ] The "permissions-policy" entry is removed from WHY, and both tests in that file pass.
• [ ] expectFloor in test/web.test.ts checks that each of camera, microphone, geolocation, payment, usb and interest-cohort is denied. It already runs on a page, an API answer and a 404.
• [ ] bun x tsc --noEmit is clean before the push. This is the step both earlier pulls skipped.

Files: src/http/respond.ts, test/forge-webspec.test.ts, test/web.test.ts. Risk: the floor also adds HSTS and CSP to what forge-webspec sees. If that raises or clears another finding, adjust KNOWN to match the real output and say so in the pull.