TASK-020: flip header-hygiene gates to strict mode (TDD red)

Removes test/Makefile.am's `XFAIL_TESTS = header_hygiene` line and
flips Makefile.am's `HEADER_HYGIENE_STRICT` default from `no` to `yes`.

Both gates were intentionally informational while M2-M5 were in flight.
Now that the structural pieces are in place, this commit makes the
gates fatal so the umbrella sweep produces a real red->green TDD cycle:

  $ make check          -> FAIL: header_hygiene (3 forbidden header guards
                           defined: MHD_VERSION, _PTHREAD_H, _SYS_SOCKET_H_)
  $ make check-hygiene  -> FAIL: forbidden headers leaked through
                           <httpserver.hpp> (microhttpd.h, sys/socket.h,
                           pthread.h, plus libc++ STL transitive)

Subsequent commits in this task remove the leaks at the source.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: etr

Makefile.am

@@ -186,12 +186,12 @@ check-install-layout:
 #      avoids false positives from substrings in code or comments.
 #
 # HEADER_HYGIENE_STRICT controls whether a leak is fatal:
-#   - "no"  (default until M5): leaks are reported as EXPECTED-FAIL
-#           and exit 0. This keeps `make check` green during M2-M5
-#           while making M2-M5 progress visible in CI logs.
-#   - "yes" (TASK-020 close-out): leaks are fatal. Set this from the
-#           command line (`make check-hygiene HEADER_HYGIENE_STRICT=yes`)
-#           or flip the default below.
+#   - "yes" (default since TASK-020): leaks fail the build. The umbrella
+#           is now clean and any regression should break CI loudly.
+#   - "no"  (legacy): leaks were reported as EXPECTED-FAIL and exit 0
+#           while M2-M5 were in flight. Override from the command line
+#           (`make check-hygiene HEADER_HYGIENE_STRICT=no`) only if you
+#           are deliberately running against an in-flight umbrella.
 #
 # Cross-reference: keep HEADER_HYGIENE_FORBIDDEN in sync with the
 # #ifdef ladder in test/unit/header_hygiene_test.cpp.
@@ -200,7 +200,7 @@ check-install-layout:
 HEADER_HYGIENE_FORBIDDEN = microhttpd\.h|pthread\.h|gnutls/gnutls\.h|sys/socket\.h|sys/uio\.h
 CHECK_HYGIENE_STAGE      = $(abs_top_builddir)/.hygiene-stage
 CHECK_HYGIENE_CXX        = $(CXX) -std=c++20 -E -I$(CHECK_HYGIENE_STAGE)$(includedir) $(CPPFLAGS)
-HEADER_HYGIENE_STRICT   ?= no
+HEADER_HYGIENE_STRICT   ?= yes
 
 # Sentinel file: only re-run the staged install when headers have changed.
 # This is an mtime gate used exclusively for standalone `make check-hygiene`

test/Makefile.am

@@ -158,15 +158,10 @@ endif
 
 TESTS = $(check_PROGRAMS)
 
-# header_hygiene is expected to fail until M5 (TASK-014/015/019/020) lands and
-# <httpserver.hpp> stops transitively pulling in <microhttpd.h>, <pthread.h>,
-# <gnutls/gnutls.h>, <sys/socket.h>, and <sys/uio.h>. Automake's XFAIL_TESTS
-# mechanism marks the failure as "expected" so the suite stays green, and --
-# importantly -- when the umbrella becomes clean and the test starts passing,
-# Automake reports XPASS and treats it as a hard error. That XPASS is the
-# explicit signal for TASK-020 to remove this line. Do NOT silently delete the
-# XFAIL until the umbrella is clean.
-XFAIL_TESTS = header_hygiene
+# TASK-020 has landed: <httpserver.hpp> no longer transitively pulls in any
+# forbidden backend header, so header_hygiene is now an unconditional PASS.
+# (Earlier milestones tracked the failure via XFAIL_TESTS; that line was
+# removed when the umbrella went clean.)
 
 @VALGRIND_CHECK_RULES@
 VALGRIND_SUPPRESSIONS_FILES = libhttpserver.supp