fix: enforce read-only policy on HTTPS

[mark-e-deyoung]

Security impact

HTTPS created a CoreEngine without applying the process-wide read-only setting, while pipe, TCP, and HTTP applied it. Mutating methods could therefore bypass --read-only over HTTPS.

Changes

• apply read-only policy to the HTTPS core before serving requests
• add a five-transport replay trace covering an allowed query and denied mutation
• add a dedicated bounded TLA+ transport-policy model and make it part of formal CI

Validation

• MSVC Release wininspectd build: pass
• full est_core CTest target: pass (9.21s)
• TLC WinInspect_TransportPolicy, depth 4, five transports: 56,252 generated / 6,250 distinct states, no violations
• git diff --check`n
  Partial remediation for Security: enforce authorization and exposure policy across transports #300. The broader bind/auth/Origin/named-pipe work remains separate. Networking family generalization is tracked in Networking: support IPv4-only, IPv6-only, and dual-stack environments end to end #304.

Stacked on #303.