feat(api): Gary header contract — read-only parsing of X-Gary-* headers

[OriginalGary]

Summary

• Parses four X-Gary-* request headers on every /v1/chat/* call: X-Gary-Action-Id, X-Gary-Stage, X-Gary-Playbook, X-Gary-Sensitivity
• All headers are optional; missing or unknown enum values → warn + treat as absent, never 4xx
• Parsed context stored in a 20-entry in-memory ring buffer, surfaced in /api/monitoring/health as garyContextHistory
• Requests with ≥1 Gary header are persisted to audit_log under action: "gary.context"
• Four Gary headers added to CORS allowed headers

Files changed

File	Change
src/lib/gary/context.ts	New module: parser, enum sets, ring buffer, audit hook
src/sse/handlers/chat.ts	Call parseGaryContext() at handleChat() entry
open-sse/utils/cors.ts	Allow x-gary-* headers in CORS preflight
src/lib/monitoring/observability.ts	Add garyContextHistory to health payload
src/app/api/monitoring/health/route.ts	Wire getRecentGaryContexts()
tests/unit/gary-context.test.ts	14 tests: all headers, subsets, none, bad enum, long/unicode action-id, case-insensitivity, ring buffer cap

Test plan

• 14 unit tests, all passing (node --import tsx/esm --test tests/unit/gary-context.test.ts)
• No new TypeScript errors in changed files (pre-existing errors in health route are unrelated, not in typecheck:core scope)
• Curl example: curl -H "X-Gary-Stage: plan" -H "X-Gary-Playbook: code-pr" -H "X-Gary-Action-Id: abc-123" -H "X-Gary-Sensitivity: tier-2" http://localhost:20128/v1/chat/completions ...

Design decisions for later prompts

• Ring buffer is in-process memory; resets on server restart — fine for N=20 visibility, not for durable audit (that goes to audit_log)
• parseGaryContext is called only from handleChat(), covering /v1/chat/completions, /v1/messages, /v1/completions, /v1/responses; embeddings/search/rerank do not fire (Gary pipeline only uses chat endpoints)
• @omniroute/open-sse alias not touched (deferred from brand sweep)

🤖 Generated with Claude Code

[github-actions]

CI Coverage Report

• Coverage job: success
• PR test policy: success

Coverage artifact was not available for this run.