feat: add process-global HTTPX instrumentation

[parvahuja]

Runtime stack 5 of 5 · depends on #191 · top of stack

Summary

• add explicit process-global instrument(runtime) for HTTPX clients created by other libraries
• require an origin policy unless unrestricted use is explicitly enabled
• share one fixed runtime with reference-counted install/disable handles
• give per-client adapters precedence and suppress payment-method recursion
• validate and transactionally patch/restore the four HTTPX auth/request-send seams

Review boundary

Process-global HTTPX only. It adds no context-local mode, task registry, thread/executor monkey-patching, response/refetch hooks, receipt extensions, or MCP instrumentation. Raw external worker threads work; payment methods must not spawn raw threads that make instrumented HTTPX calls.

Production delta is 251 lines.

Validation

• full suite: 939 passed, 41 skipped
• combined adapter/instrumentation suite: 40 passed on HTTPX 0.27.0 and 0.28.1
• Hermes 0.19 and current-main entrypoint smokes, including clients and bound send callables created before plugin load
• raw-thread, reference-count, rollback, third-party patch, factory/method recursion, precedence, auth, redirect, and nested-send smokes
• clean wheel build and strict Twine validation
• Ruff, formatting, and Pyright pass