feat(safe-bash): expose curl response body intent to transports

[kamilio]

Curl transports currently see the HTTP method but cannot tell whether curl will consume the response body. For example, -I -X GET sends GET while omitting the body, and -f suppresses HTTP error bodies. An eager browser transport can therefore read or reject a body that curl would never consume.

Add optional HttpRequest.responseBodyMode with read, omit, and omit-on-http-error values. Curl supplies it at the shared transport call, preserving it across redirects and retries. Existing parsed flags determine the mode: -I omits, -f omits only for status >= 400, and normal requests and --fail-with-body read. Omitted metadata defaults to read for other callers. Conflicting failure flags still reject before authorization, transport, or output-file effects.

The transport method, parser, and response ownership are unchanged. This provides transport intent; it does not claim full native curl parity.

Validation against 0.1.535 (b270fe04):

• Failing source regression followed by 48 passing focused cases, including redirects, retries, status boundaries, file preservation, and conflicting flags.
• Normal root build and owning typecheck passed (source/tests plus all 26 maintained current consumer groups).
• All 912 network tests and 303 maintained runner tests passed on the current baseline.
• Released 0.1.535 fails the new packed metadata regression; candidate packed smoke passes in Node and Bun, browser conditional bundle execution passes, and packed TypeScript consumer passes.
• Compiled artifact patch replays byte-for-byte across all 1,345 released package files, including browser entrypoints and their shared chunk.

Guarded root ESLint passed. CI packed public APIs passed on Node22 and Bun 1.3.11. The full Node22 virtual-bash unit suite passed. General CI passed build/lint/typecheck but its shared unit stage failed.

Current CI limitations:

• General shared unit tests: four safe-bash-playground suites fail because navigator is undefined, three toolcraft stream tests use Array.fromAsync under Node20, and the agent-harness coverage-demo replay test exceeds 5000ms. These failures remain unresolved; no runtime or timeout waiver was applied.
• Automatic review failed before a review was produced because its configured model returned HTTP 404 (gpt-6-astra not found).
• Live-agent e2e failed 7/13 tests. Claude/Codex returned explicit unavailable-model errors; Kimi emitted LLM not set; Goose reported an ACP internal error; OpenCode reported the fixture MCP tool unavailable. The same seven signatures occurred in earlier run 34433223443, whose source predates this metadata field. Goose/OpenCode root causes remain unresolved; this prior evidence does not waive the failures. No live retries or model/workflow changes were made.

CI and review remain required before merge; this PR does not publish a release.