Phase 2, Task 8: Add streaming path to publisher proxy

[aram356]

Parent: #563
Phase: #567
Depends on: Tasks 6, 7

Summary

The core streaming change. Add a streaming code path to the publisher proxy that sends response headers immediately via stream_to_client() and pipes processed chunks directly to the client.

Changes

• Add should_stream() gate: 2xx status + html_post_processors().is_empty() for HTML; always stream non-HTML
  • Only checks html_post_processors, NOT script_rewriters (script rewriters run inside lol_html during streaming)
• Reorder synthetic ID/cookie headers to run before stream_to_client() (body-independent)
• Call finalize_response() before streaming (geo, version, staging, operator headers)
• Remove Content-Length header before streaming
• Streaming path: response.stream_to_client() → process_response_streaming(body, &mut streaming_body) → finish()
• Binary pass-through: io::copy(&mut body, &mut streaming_body) (Body: Read, StreamingBody: Write)
• Error handling:
  • Pre-stream errors (processor creation) → send_to_client() with proper status
  • Mid-stream errors → log and drop StreamingBody (auto-aborts per SDK)
• Buffered fallback when gate fails (backend error or post-processors registered)

Files: crates/trusted-server-core/src/publisher.rs, crates/trusted-server-adapter-fastly/src/main.rs

Plan

See docs/superpowers/plans/2026-03-25-streaming-response.md — Task 8