perf(server): stream static files and keep deployed HTML current

[rynfar]

Static requests buffered entire files and sent reusable bundles again on every request. Stream bounded chunks from a request-scoped file handle, cache only hashed assets listed in the build manifest, and support conditional requests for mutable assets. HTML always returns the current app shell so deployments preserving file sizes and timestamps cannot strand clients on obsolete bundle URLs.

Adopts upstream #9669 and the HTML correction from #9799. Pylon auth, routing, compression, remote origins, and desktop identity stay intact. The live-stream portion of #9799 landed separately in #333; the source commit is counted only once.

Validation: the HTML regression reproduced a stale 304 before the correction; all 174 server routing tests pass afterward, including atomic replacement and handle cleanup after GET, HEAD, 304, and cancellation. Server and web typechecks, targeted lint, formatting, and diff checks pass.

Model: GPT-6 Astra. Harness: Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.7 KiB	−76 B (−0.5%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.6 KiB	−72 B (−1.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.4 KiB	57.3 KiB	−88 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.7 KiB	−137 B (−1.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−5 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.6 KiB	−132 B (−1.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.2 KiB	57.4 KiB	−884 B (−1.5%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 1e7ffff · PR result: 07cd530 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.