0.28.3 — actually export VGI-Proxy-Proof-Required

The proxy-proof spec has required the VGI-Proxy-Proof-Required capability header since 0.28.0 (§2.2). The constant was declared in all five implementations and not one of them ever emitted it — a MUST with no conformance test, so nothing caught it.

That header is the only way a proxy can tell it is minting proofs for a worker that checks them from one that ignores them, which is what makes allow → require a rollout rather than a guess.

What changed

• make_wsgi_app(proxy_proof_required=True) emits the header and adds it to Access-Control-Expose-Headers; serve_http forwards the flag.
• PROOF_HEADER / PROOF_REQUIRED_HEADER moved to _common.py (the header registry) so the factory can import them without a cycle. Non-breaking — all prior import paths still resolve.
• Two shared conformance cases: require advertises "true", allow must not (it never denies, so claiming to enforce would report a rollout complete while every unproofed direct caller still sailed through).
• Spec §2.2 now records that the flag is operator-declared, not derived — the gate installs through the opaque authenticate seam, and the real deployment shape is require_all(gate, inner), so there is nothing to introspect.

Fixed doc claim

The capability table listed vgi-rpc-test --filter "ProxyProof::*", a group that does not exist (introduced in 0.28.0). Proof tests spawn their own workers per configuration, so a tool pointed at one already-running server cannot express them.

Ports

Go, Rust, Java and TypeScript all land the header alongside this release; each was verified with a negative control — remove the wiring, watch the require case fail.