Add contract and simulation test targets

[kacy]

Summary

• add test-contract and test-sim targets plus matching make targets
• add contract-focused HTTP and S3 coverage for exact status codes, auth behavior, and response shape
• tighten request parsing and response handling around duplicate Content-Length, oversized bodies, and HEAD semantics
• add a deterministic follower catch-up simulation case and tighten oversized-body security checks

Why

These changes add stronger release-facing coverage for externally visible API behavior and deterministic cluster recovery paths, while tightening a few request-handling edge cases uncovered during the audit.

Validation

• zig build test-contract -Doptimize=ReleaseSafe

Notes

• the privileged security tests were updated to assert the real 413 path, but the privileged suite was not rerun in this pass