Tighten alias and header edge-cases called out in review

The latest review pass found a few more concrete edge-cases that were still
cheap to close: invalid /responses aliases could still rewrite typos, websocket
session headers should prefer proxy-safe dashed forms, contributor rendering
needed an input guard, and several upstream request/response helpers still had
small contract mismatches around Accept/beta handling and synthesized tool ids.
These fixes keep the release branch behavior explicit while the PR remains open.

Constraint: Keep changes surgical and well-covered so the review cleanup does not destabilize the already-green release branch
Rejected: Leave these for post-merge cleanup | they were still active review threads with straightforward fixes
Confidence: high
Scope-risk: narrow
Directive: When alias routes exist only for ergonomics, reject unknown subpaths loudly instead of silently rewriting them
Tested: Focused vitest for contributor updater, route aliases, upstream request builder, openai responses response bridge; typecheck; git diff --check
Not-tested: Full npm test; the remaining Gemini review thread that likely needs a broader canonical-tool-result contract decision

scripts/dev/update-readme-contributors.test.ts

@@ -110,6 +110,10 @@ describe('README contributors updater', () => {
     expect((html.match(/\n  <a href=/g) || []).length).toBe(2);
   });
 
+  it('rejects invalid per-line values instead of looping forever', () => {
+    expect(() => renderContributorsBlock([], 0)).toThrow('perLine must be a positive integer');
+  });
+
   it('parses concatenated paginated gh api arrays without requiring newlines between pages', () => {
     expect(parsePaginatedJson('[{"login":"a"}][{"login":"b"}]')).toEqual([
       { login: 'a' },