fix: enforce exact Cloud Function CORS allowlist

[nicholas-ruest]

What changed

• enforce exact matching for configured Cloud Function CORS origins
• withhold Access-Control-Allow-Origin for disallowed and missing origins
• normalize comma-separated origin configuration and emit Vary: Origin for dynamic allowlists
• replace the export-only smoke check with seven behavioral tests
• add a commit-pinned Linux/Node 20 CI job and include it in the existing aggregate gate

Frozen evidence

Base: 7e0ec19c3035e98176db0d31cdef2d3ea9616b31

• baseline Cloud Function contract: 2/7
• exact candidate: 7/7
• npm production audit: 0 vulnerabilities
• MetaHarness 0.4.17 score: 71, exit 0
• Darwin 0.10.3, real sandbox, seed 2026101014: NO_IMPROVEMENT (baseline retained; 0.435, delta 0)
• Flywheel 0.1.12 live holdout: 1/6 → 6/6, frozen anchor 5/5 → 5/5
• Flywheel default gate: PROMOTED, primary delta +0.8333333333333334
• signed replay: PASS for Ed25519 receipts, lineage/root, parent continuity, sealed evidence, and pinned gate fingerprint c5942e7c9bf8f28fe7af47a6ec3887d11eeb3f8c8e8601cc6a7a54969ea0b981

Existing repository gates

No Rust source or Cargo manifest changed. The local workspace still fails its pre-existing formatting gate, and local cargo check additionally lacks system pkg-config/OpenSSL metadata. This PR does not remove or relax either Rust gate; merge remains contingent on the exact GitHub candidate satisfying required checks.

Rollback

Revert the merge commit for this PR. That atomically restores the prior handler, test script, and CI job. No deployment or package publication is included.

Full command evidence and acceptance contract are in docs/metaharness/2026-10-10-cloud-function-cors.md.

[nicholas-ruest]

Exact-head revalidation for 0e4304aaf3e8e9ced19b680b22f7ea0f6010645d:

• Cloud Function: PASS (clean install, 7/7 tests, production audit)
• Security Audit: PASS
• Rust toolchain setup: PASS after replacing the nonexistent action with the official pinned action
• Lint: FAIL at the repository's pre-existing cargo fmt --all -- --check drift
• Build / Test / Coverage: FAIL on the pre-existing llm-research-core/src/error.rs reference to undeclared feature database under RUSTFLAGS=-Dwarnings
• Aggregate All Checks Pass: FAIL
• PR remains mergeable and 0 commits behind main, but is intentionally not merged because the required aggregate gate is red.

The exact head was also rerun through Flywheel: holdout 1/6 → 6/6, anchor 5/5 → 5/5, signed replay and pinned gate fingerprint PASS. No Rust source or Cargo manifest is changed by this PR.