test: prove HTTP action execution boundaries

[shivros]

Summary

• Centralize generic http_post request construction used by webhook ingress and Iris subscription actions.
• Add deterministic local receiver coverage for configured headers, rendered templates, content-type defaults/overrides, and legacy JSON delivery.

Verification

• cargo build --all-targets
• cargo test --all-targets — 38 tests passed
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p rite-codegen -- check
• creed diff
• git diff --check

Closes COD-471.

No deployment, configuration, or Iris protocol change is included.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6 Terra

APPROVE. The shared builder preserves configured headers, case-insensitive explicit Content-Type precedence, templated text/plain defaulting, and no-template JSON delivery across both webhook and Iris paths.

Reviewer B — independent review

APPROVE. Local receiver coverage exercises webhook ingress and a real mock Iris SSE source. It confirms configured headers, exact rendered bodies, template content-type default/override, and legacy JSON semantics.

Minor note considered: webhook dispatch awaits each action, so capture order is deterministic. The receiver itself has explicit graceful shutdown; Iris subscription task lifecycle is existing production behavior and was not changed by this evidence-only slice.

[shivros]

Auto-Merge Gate

Confidence: 0.96

The PR directly satisfies COD-471: it centralizes the existing generic request builder and adds deterministic local receiver coverage for webhook and Iris paths, including configured headers, rendered template bodies, default/explicit content types, and legacy JSON behavior. It remains a small, private rite-server change with no public-surface, deployment, credential, or protocol change.

Checks observed: GitHub test, Creed context drift; local cargo build --all-targets, cargo test --all-targets (38 tests), strict Clippy, cargo fmt --all -- --check, and cargo run -p rite-codegen -- check all passed.

No manual-review marker or unresolved blocking review was found in COD-471 or the PR discussion.