Security:
- #240 reserved framework-object params bind before same-named URL segments

Fixed:
- #260 CGI workers preserve multiple same-name response headers
- #261 cgiMode('fcgi') no longer fatals every request (coroutine-wrapped FastCGI)
- #270/#274 $g->server CGI/SAPI vars at worker start + per-request UNIQUE_ID
- #271 RedisSessionHandler connects lazily (no HOOK_ALL fatal in onWorkerStart)
- #26 boot-time $GLOBALS visible to all request coroutines (needs ext-zealphp 0.3.33+)

Plus the architecture-review hardening pass (backpressure, sessions, cross-node fabric).
Companion: ext-zealphp v0.3.33.