fix: start stateless stream collection after response headers

[birbprophet]

Fixes #530.

listenToStream starts its 500–1500 ms collection timer before awaiting fetch, so response-header latency consumes the entire window. A response that arrives after 500 ms can become a generic empty-frame failure before the logging check inspects it. The same helper affects the independent-request and subscription checks.

Give response headers the existing 10-second stateless request timeout, then reset the timer to the original probe-specific collection window when fetch returns. The header request remains abortable, an open body still ends at its original deadline, and the runner's scenario timeout is unchanged. Reuse one exported constant for the existing ordinary request timeout. Check IDs, severities, frame limits, fixture requirements, and protocol assertions are unchanged.

Add 12 abort-aware fake-timer regressions across the logging and independent-request probes. They cover valid frames near the end of the full post-header window, delayed missing-tool errors remaining failed/untestable, delayed forbidden content still failing for the actual violation, open bodies with no frames, frames arriving after the collection deadline, and headers that never arrive within the ordinary request budget. Six delayed-response regressions were observed failing against the original helper before the fix.

Validation:

• vp run check (the repository's typecheck and lint scripts): passed.
• vp run build: passed.
• vp run test: 47 files / 634 tests passed in 323.73 seconds.
• Focused stateless, stateless-connection, and runner tests: 48 passed, including the existing scenario-timeout regression.
• Built CLI against the bundled TypeScript SDK everything-server: 30/30 stateless checks passed.
• Real HTTP reproduction with a proxy delaying only test_logging_tool and test_streaming_elicitation response headers by 1000 ms: published alpha.11 failed exactly those two checks (28/30); the same alpha.11 bundle with only this helper backported passed 30/30. No server behavior, fixture, or assertion changes were needed.

The explicit header bound also makes this fix safe to backport to alpha.11 independently of #454. The initial sandboxed full-suite attempt could not open local test sockets/tsx IPC; the reported full pass is the subsequent run with local socket access.