refactor(transport): move HTTP, framing, runtime hints, and auth mechanics

[thymikee]

Parent: #2129

Blocked by: none. Wave 1; this child is the explicit transport/auth owner and must preserve the lazy HTTP closure.

Scope — exact tracked files

Production:

• src/utils/line-stream.ts
• src/utils/node-http.ts
• src/utils/runtime-transport.ts
• src/utils/timing-safe-equal.ts

Tests:

• src/utils/__tests__/daemon-client.test.ts
• src/utils/__tests__/daemon-client-lifecycle.test.ts

Destination and importer edits

Move the line parser and outbound/request-body HTTP adapter to:

• src/daemon/client/line-stream.ts
• src/daemon/client/node-http.ts

Move runtime-hint parsing and secret comparison to the daemon server transport/auth boundary:

• src/daemon/server/runtime-transport.ts
• src/daemon/server/timing-safe-equal.ts

Move the two misplaced daemon-client tests to:

• src/daemon/client/__tests__/daemon-client.test.ts
• src/daemon/client/__tests__/daemon-client-lifecycle.test.ts

Update exact production importers:

• src/daemon/client/daemon-client-progress.ts -> line parser
• src/daemon/server/transport.ts -> line parser
• src/daemon/client/daemon-client-transport.ts -> node HTTP
• src/daemon/upload-http.ts -> node HTTP
• src/remote/daemon-artifacts.ts -> node HTTP
• src/remote/daemon-proxy.ts -> node HTTP and timing-safe comparison
• src/remote/remote-request-diagnostics.ts -> node HTTP
• src/remote/upload-stream.ts -> node HTTP
• src/daemon/request-router.ts -> timing-safe comparison
• src/daemon/server/http-server.ts -> timing-safe comparison
• src/daemon/handlers/session-runtime.ts -> runtime transport
• src/metro/metro-reload-endpoints.ts -> runtime transport
• src/metro/metro.ts -> runtime transport
• src/platform-runtime-runtime-hints.ts -> runtime transport

Update the existing src/__tests__/platform-runtime-runtime-hints.test.ts import in place; it is not a utility test. Existing daemon HTTP/remote tests remain at their current owners.

Behavior invariants

Preserve line trimming/empty-line suppression/partial-buffer retention, bounded request-body errors, response-body decoding, protocol-specific lazy node:http/node:https loading, and mutable requester stubbing. The CLI startup import-closure must not statically load either Node HTTP module.

Preserve runtime host/port/scheme resolution, bundle URL precedence, default ports, invalid-URL error behavior, and undefined-on-incomplete-hints behavior. Preserve length-independent constant-time secret comparison and all auth refusal behavior. Preserve daemon client lifecycle, retry, timeout, progress, and wire payload behavior exactly. Do not classify these files by the presence of Node builtins; their owners are transport and auth policy.

Focused validation

Run:

• pnpm vitest run src/daemon/client/__tests__/daemon-client.test.ts src/daemon/client/__tests__/daemon-client-lifecycle.test.ts
• pnpm vitest run src/__tests__/platform-runtime-runtime-hints.test.ts src/daemon/__tests__/http-contract.test.ts
• the existing src/__tests__/cli-startup-import-closure.test.ts and remote/daemon HTTP tests
• pnpm check:affected --run

Planted-red proof

No new structural rule is added. Temporarily introduce a static value import of node:http in the eager CLI closure and observe the existing startup-import-closure test fail by name; remove it before the green run. Temporarily return the wrong runtime default port and observe the runtime-hints test fail. Keep the existing auth tests independent of the comparison implementation.

Dependency order

Wave 1. The surface-output child may depend on this child only if its final imports touch the transport formatter; otherwise it is independent. The terminal child is blocked by this child.

Shrink target

Delete all four old utility modules and both misplaced daemon-client tests. Preserve lazy imports without a compatibility shim or generic src/transport top-level zone. After discounting physical moves, production LOC must not grow and no new public package export is allowed.