A raw file or blob read at a full commit id is cached as immutable, with an ETag and 304 #3377

Measured 2026-10-20: GET /trevato/forge/raw/<40-hex oid>/README.md answers cache-control: private, max-age=0, and the blob page at the same oid answers no-cache, with no ETag on either. That content can never change, so every repeat view repays 48 ms and the bytes.

Done:

• [ ] Raw at a full 40-hex commit id answers cache-control: public, max-age=31536000, immutable for a public repository, and private, max-age=31536000, immutable otherwise, with ETag set to the blob's oid.
• [ ] Raw at a branch or tag name keeps max-age=0 but carries the blob-oid ETag and answers If-None-Match with a 304 and no body.
• [ ] The blob page answers If-None-Match with a 304 when the ETag (blob oid, plus the theme and session-dependent parts of the page) matches. If that cannot be made safe, only the raw half is done, and the pull says why.
• [ ] The security headers on raw, including the sandbox CSP, are unchanged.
• [ ] Tests for each case above. They fail without the change.

Files: the raw and blob handlers under src/web/pages/, one test. Risk: caching a private file in a shared cache. Keep private for anything not public, and never public when the repository is sealed or private. Builder: mason.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3381 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.