[tsenart]

relay, link: forward only the headers Perfloop sends; harden the edges

• Only Accept, Accept-Encoding, User-Agent, and X-Scope-OrgID cross from a
  read to the upstream (link.ForwardedHeaders, defined once so the API side
  reads the same list); every other request header stops at the relay, and
  the customer's configured headers still win. -print-routes prints them.
• Every Perfloop-* response header from an upstream is removed before the
  answer crosses the tunnel.
• Proxy-Authorization and Proxy-Authenticate join the hop-by-hop list.
• One read's response write carries the same two-minute deadline as its
  upstream request, so withheld flow-control credit cannot pin a stream.
• ExpandEnv refuses an unterminated ${ reference instead of truncating.
• The Kubernetes example also excludes 100.64.0.0/10 from public egress.
• image.yml splits the pull-request build from the main-only publish job so
  pull requests run with read-only permissions; ci.yml uses the official
  golangci-lint action pinned by commit.
• Tests: hostile headers never reach the upstream, forged Perfloop-* response
  headers are stripped, an upstream redirect is refused, one tunnel carries at
  most eight reads at once, and unterminated references are refused.

🤖 Generated with Claude Code