feat(api): execute registered reads in isolated requests

[Upd4ting]

Purpose

Recover and complete the registered-read API foundation. This is not the completed document-owned attachment workflow.

• Run a trusted registered GET through prefixes, computed properties, parameters, the selected handler and postfixes.
• Preserve credentials and peer address metadata on an isolated request with a detached socket. Reject raw response output, transport writes/timeouts/connections, interception, redirects, streams, cancellation and mismatched routes.
• Validate the handler response before postfixes so a postfix cannot turn a denial into authorization.
• Observe started promises when later synchronous cancellation interrupts dispatch.
• Support server-selected query values for routes such as /get?id=..., without inheriting the parent query or changing strict pathname validation.
• Preserve sparse parameter arrays in ordinary HTTP dispatch.

The caller must choose a trusted read target and validate the returned entity; this API does not authorize unrelated objects. Full TLS transport APIs and the live parent connection are not exposed to the child. Parent-disconnect cancellation is not part of this contract.

Verification

• pnpm build: pass against the locally packed companion interface.
• ajs module test . -f dist/test/registered-read.test.js: 38 passing.
• ajs module test . -f dist/test/controller-resolution.test.js: 9 passing, including the sparse-parameter regression.
• pnpm dlx @antelopejs/core@1.5.1 module test .: 215 passing, 1 failing. The same callback-identity assertion in the interface dependency fails on unmodified origin/main with the identical interface archive: 176 passing, 1 failing.
• pnpm lint, pnpm format:check, pnpm knip, git diff --check: pass, with existing warnings/configuration hints.
• Oracle reviewed the inherited implementation and the first fixes. All concrete findings from both reviews now have fixes and targeted regressions. Five first-review regressions failed before fixes. Separate standards and spec reviews completed; this remains foundation-only scope.

Merge blocker: unpublished dependency

Depends on AntelopeJS/interface-api#20.

The optional @antelopejs/interface-api/registered-read export is not published yet. The committed dependency range and frozen lockfile still select the old interface, so a clean CI build is expected to fail until the companion interface PR is merged and released, then this PR's dependency floor and lockfile are updated.

Local tarball paths were used only for validation and are not committed. Keep this PR in draft; do not merge, publish or deploy it as a standalone change.