feat(agent-test): add a hardened loopback HTTP driver

Description

The pitch.

## Problem

Town needs a small local adapter transport with strict authentication, bounds, timeouts, and failure attribution before external agents can safely participate in a test run.

## Change

- add an authenticated literal-loopback HTTP driver for the version 1 wire contract
- enforce canonical origins, fixed paths/headers, body limits, digest binding, and no proxy/redirect behavior
- sanitize remote/parser failures and bind responses to the originating profile codec
- add real-socket adversarial and golden-vector coverage

## Verification

- final stack: `make ci-local` — all 5 checks passed; 2,081 passed, 2 skipped, 1 deselected
- socket-level transport, timeout, cancellation, parser-limit, and secret-canary tests pass
- independent security review found no Critical or Important issues

## Stack

**3 of 9. Depends on PR 2.** PR 4 targets this branch. This PR is transport only; orchestration and user commands follow.

**Merge note:** After #221 merges into `main`, retarget this PR to `main`, wait for its CI, and only then merge it.