Harden v3 cookie attribute validation

[tim-smart]

Summary

• validate cookie names using the RFC 6265 token grammar
• reject cookie attribute delimiters in domains and paths
• apply the cookie-name validation when parsing Set-Cookie headers
• add rejection and legitimate-value regression coverage

Verification

• pnpm test run packages/platform/test/Cookies.test.ts
• pnpm lint
• pnpm check
• pnpm build
• pnpm docgen

The full pnpm test run completed with 7,539 passing tests and three unrelated failures. The MSSQL timeout and process-group timing test passed when rerun independently; the existing BigDecimal clamp assertion remains reproducible independently.

Closes EFF-211

[changeset-bot]

🦋 Changeset detected

Latest commit: a7d1627

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@effect/platform	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pullfrog]

• Read the complete diff and PR summary snapshot
• Triage: understand what the PR changes, examine related files and tests
• Specialist decision: determine if any subagent review is needed
• Aggregate findings & draft review
• Submit review via pullfrog_create_pull_request_review
• Update PR summary snapshot

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) ｜ 𝕏}