fix: resolve runtime compiler and tooling regressions

[cssbruno]

Summary

• Harden runtime HTTP behavior with typed oversized-body failures, standards-aware Accept negotiation, structured multipart parsing, independent metrics/tracing, bounded trace export, and CSRF secret rotation.
• Fix compiler/build contracts for canonical route collisions, component-local WASM assets, bounded source scanning, and executable addon capability descriptors.
• Fix CLI flag parsing and configured LSP component discovery, and clarify handler/markup ownership across the documentation and examples.
• Update generated source, goldens, diagnostics, security guidance, reference docs, and regression tests with the affected contracts.

Root causes included permissive parsing and unbounded queues/scanners, configuration metadata that was documented but not executed consistently, and discovery/build paths that discarded project-local context.

Issue Closure

Closes #715
Closes #725
Closes #727
Closes #732
Closes #734
Closes #735
Closes #736
Closes #738
Closes #739
Closes #740
Closes #759
Closes #764

Related: #695

Generated Output / Compatibility

Generated Go app source and component WASM asset paths change where required by the fixes; the generated-source golden is updated. Existing CSRF secrets remain valid, with optional verification-only secrets enabling rotation. No removed language syntax is introduced.

Verification

• Changed Go files formatted with gofmt
• git diff --check
• go build ./cmd/gowdk
• scripts/check-docs-links.sh
• scripts/check-docs-style.sh
• scripts/check-removed-syntax.sh
• scripts/check-doc-versions.sh
• Focused tests for the affected runtime, compiler, project, LSP, discovery, app generation, and trace packages
• scripts/test-go-modules.sh completed most packages, but the final internal/gowdkcmd pass exhausted the temporary build quota and produced secondary VCS-stamping failures; the rerun was stopped before publication at the user's request

LLM Assistance

• Session summary: implemented, reviewed, formatted, and published a batch of completed GitHub issue fixes across runtime, compiler, generated output, CLI, LSP, configuration, tests, and docs.
• Human-reviewed assumptions: the requested PR scope is the completed issue batch in this worktree; the interrupted [LSP] Bound JSON-RPC headers, message bodies, and open-document memory #695 slice was removed before commit.
• Follow-up work: finish [LSP] Bound JSON-RPC headers, message bodies, and open-document memory #695 separately with its full transport/document-limit test matrix.