refactor(proxy): extract ccr golden replay policy

[JerrettDavis]

Description

Extracts CCR golden tool replay and fresh-definition canonicalization from headroom.proxy.helpers.apply_session_sticky_ccr_tool into a focused policy module. This keeps sticky CCR orchestration in helpers while making the byte replay/regeneration behavior independently testable.

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Performance improvement
• Code refactoring (no functional changes)

Changes Made

• Added headroom.proxy.ccr_golden_policy for replaying stored CCR golden bytes and creating canonical fresh CCR tool definitions.
• Updated apply_session_sticky_ccr_tool to delegate CCR golden replay/fresh definition policy while preserving tracker coordination and logging decisions.
• Added direct tests for golden-byte replay, invalid/corrupt bytes, non-UTF-8 bytes, and fresh canonical definition generation.

Testing

• Unit tests pass (pytest)
• Linting passes (ruff check .)
• Type checking passes (mypy headroom)
• New tests added for new functionality
• Manual testing performed

Test Output

python -m pytest tests/test_ccr_golden_policy.py tests/test_ccr_tool_always_on.py tests/test_corrupt_golden_bytes_recovery.py tests/test_proxy/test_ccr_frozen_prefix_coupling.py
30 passed in 0.34s

python -m ruff check .
All checks passed!

python -m ruff format --check .
1069 files already formatted

python -m mypy headroom --ignore-missing-imports
Success: no issues found in 410 source files

gitleaks protect --staged --no-banner --redact
no leaks found

Real Behavior Proof

• Environment: Windows, Python 3.13.13, clean worktree from headroomlabs/main at d2170b19.
• Exact command / steps: Ran targeted CCR golden replay/sticky injection/corrupt-byte regression tests plus ruff, ruff-format, mypy, and staged gitleaks scan.
• Observed result: All targeted tests and local gates passed; staged secret scan found no leaks.
• Not tested: Full Docker/native wrapper CI locally; covered by repository CI.

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the CHANGELOG.md if applicable

Screenshots (if applicable)

N/A.

Additional Notes

Documentation and changelog updates are not applicable for this internal refactor. The push reported existing default-branch Dependabot vulnerabilities; this PR's staged gitleaks scan passed and CI security checks are expected to validate the branch.

[github-actions]

PR governance

This PR follows the template and is marked ready for human review.