v1.8.8 - relay drain deadline, resume-trust regression (TESTING)

TESTING ONLY - not production. v1.8.5 remains the approved latest release.

Second review pass on the v1.8.7 merge. One real defect fixed and one coverage gap closed.

[1.8.8] - 2026-10-11

TESTING CANDIDATE - review follow-up on v1.8.7.

• relay/app.py: bound the early-rejection body drain with a total monotonic
  deadline instead of a per-read socket timeout. The per-read form let a client
  that trickled one byte per interval keep an unauthenticated handler thread
  (ThreadingHTTPServer spawns one per connection) alive indefinitely - a
  slowloris on the 401/404/415/411/413/400 paths. A handler now retires at the
  drain deadline regardless of how slowly the body arrives.
• Add tests/test_resume_materials_trust.ps1: the v1.8.7 resume-location ACL
  change had no automated coverage. It asserts a user-writable location is
  refused and a protected System32\\drivers location is accepted (the
  pre-merge check rejected that path), and it is wired into both CI editions.
• Relay regression test_reject_drain_is_bounded_against_a_trickling_client
  reproduces the slowloris (handler thread alive 13.5 s) and passes at ~5.5 s
  with the deadline in place.

Exact source: f01139219edeb39515549085722f9312064be70d.

Windows CI (Server 2022 + 2025, PowerShell 5.1 and pwsh, including the extracted-ZIP fixtures) passed on both runners. The attached ZIP is the tested Windows 2022 CI artifact, published byte-identical - not rebuilt. relay/ and tests/ are not part of this bundle (server-side / dev only).