v0.2.9 — Core guards in workers and composable response headers

Core guard rules are now registered under CLI as well as HTTP, so View rendering and HTML escaping work in commands, queue workers and scheduled jobs after application boot. Blocklist rules read configuration when called and allow a missing list instead of throwing a TypeError.

The response.header event now passes each returned PSR-7 response to the next listener. Application headers and the language cookie from naf/i18n can coexist. Other dispatch methods retain their behaviour.

Regression coverage exercises CLI guards and response chaining. The package suite passes (175 tests), and CI passes for the released commit.