v2026.08.23.9

static_resource per-request billing + serve hardening (consumed by enterprise via submodule bump). Gateway bills a static_resource pull per served GET, kept out of per-GB egress (HEAD/304 free); static_resource content-type allowlist; serve hardening (nosniff always; attachment + CSP sandbox for html/xhtml/svg) scoped to static_resource. Verify: gateway tsc clean, billing 8 tests, gateway asset suite 448 tests.