fix(protect): close runtime template coverage gaps

[patchstackdave]

Stacked on #347.

• Screen parsed Fastify form bodies correctly and filter buffered onSend responses while preserving cookies, status and framing.
• Enable existing bounded response filtering in generated Express and Node middleware.
• Refresh live rules in long-lived production runtimes and tolerate absent process globals in Fetch templates.
• Preserve Fetch handler receivers and host arguments.
• Verify executable seam wiring, not marker comments. Upgrade only fingerprint-recognized unchanged generated helpers; retain customized helpers and site identity.

Validation: complete suite (4,162 passed, seven skipped before the upgrade regression); 56 targeted tests including upgrade safety; all nine template typechecks; build. Real Fastify tests cover JSON/forms, benign controls, sibling routes, output redaction, cookies, streaming and bodyless responses. Existing response-engine tests cover size limits, encoding and framing.

Source inspection is not proof of live rule delivery. Streams and unsupported custom hooks remain explicit limitations. Public-boundary review completed; fixtures are synthetic.

[coderbuds]

Centralizes template upgrades with installTemplate and expands coverage tests.

🎯 Quality: 83% Excellent · 📦 Size: Large — consider splitting if possible

🛡️ Standards: Not checked — 501 lines changed, over your team's 400-line limit, and nothing checked before it was opened. Coding agents can call the assess-change-fit tool first, while a change this size is still cheap to split.

🤖 Authorship: Probably agent-written — OpenAI Codex, going by its branch name. Whether a person read it is unknown; coding agents can call the report-ai-usage tool to say.

📈 This month: Your 206th PR — above team average · Averaging Good

_{See how your team is trending →}

[patchstackdave]

/review