The every-GET-route floor test is two tests, signed out and signed in, each well inside its own 9 s budget #8114

Replaces #8062, where three reviews of #8078 agreed on what was wrong: dropping the signed-in request for public 200 routes removes coverage, and the change that keeps coverage (accept-encoding: identity) saves only ~0.5 s of a pass that ran 9.53 s locally.

The work: split test/security-floor-routes.test.ts "every GET route, and an unknown path, carries the floor signed out and signed in" into two tests over the same path list, one with no cookie and one with the session cookie. Each keeps the 9_000 ms budget (#1242: no budget is raised). Each pass does about half of today's ~712 requests.

Done looks like:

• [ ] Two tests, one signed out and one signed in. Every path from getPatterns().map(pathFor) plus the two unknown paths is requested in both. No route is skipped because of its status.
• [ ] The assertion is unchanged: every response carries Content-Security-Policy, X-Content-Type-Options and Referrer-Policy, and floor() returns string[].
• [ ] Requests send accept-encoding: identity, which is safe because compress(...).then(securityFloor) in src/http/server.ts still applies the floor. No BATCH or concurrency knob is added.
• [ ] The pull states each test's time as bun test test/security-floor-routes.test.ts printed it, and each is under 6 s.
• [ ] The forge check passes on the push.

Files: test/security-floor-routes.test.ts Risks: the shared server setup must not run twice. If one pass is still over 6 s, say so in the pull with the number rather than raising the budget. Brief: mason (who holds #8078 and can land it there) or any builder.