Tighten alias and header edge-cases called out in review

The latest review pass found a few more concrete edge-cases that were still
cheap to close: invalid /responses aliases could still rewrite typos, websocket
session headers should prefer proxy-safe dashed forms, contributor rendering
needed an input guard, and several upstream request/response helpers still had
small contract mismatches around Accept/beta handling and synthesized tool ids.
These fixes keep the release branch behavior explicit while the PR remains open.

Constraint: Keep changes surgical and well-covered so the review cleanup does not destabilize the already-green release branch
Rejected: Leave these for post-merge cleanup | they were still active review threads with straightforward fixes
Confidence: high
Scope-risk: narrow
Directive: When alias routes exist only for ergonomics, reject unknown subpaths loudly instead of silently rewriting them
Tested: Focused vitest for contributor updater, route aliases, upstream request builder, openai responses response bridge; typecheck; git diff --check
Not-tested: Full npm test; the remaining Gemini review thread that likely needs a broader canonical-tool-result contract decision

scripts/dev/update-readme-contributors.test.ts

@@ -110,6 +110,10 @@ describe('README contributors updater', () => {
     expect((html.match(/\n  <a href=/g) || []).length).toBe(2);
   });
 
+  it('rejects invalid per-line values instead of looping forever', () => {
+    expect(() => renderContributorsBlock([], 0)).toThrow('perLine must be a positive integer');
+  });
+
   it('parses concatenated paginated gh api arrays without requiring newlines between pages', () => {
     expect(parsePaginatedJson('[{"login":"a"}][{"login":"b"}]')).toEqual([
       { login: 'a' },

scripts/dev/update-readme-contributors.ts

@@ -64,6 +64,10 @@ export function renderContributorsBlock(
   contributors: ReadmeContributor[],
   perLine = PER_LINE,
 ): string {
+  if (!Number.isInteger(perLine) || perLine <= 0) {
+    throw new RangeError('perLine must be a positive integer');
+  }
+
   if (contributors.length === 0) {
     return '<p align="left">\n  <sub>No public contributors found yet.</sub>\n</p>';
   }