refactor(platform): merge registry-platform-replay into registry-platform-cache, document httputil/httpsec boundary

[jeremi]

Context

The 2026-07-07 architecture review found registry-platform-cache and registry-platform-replay are two trait layers over one semantic, with replay as cache's only platform consumer. All platform crates are version-locked and single-file, so the crate boundary buys no versioning independence today, and merging is a public-API break after 1.0: it happens now or never. The review also flagged the registry-platform-httputil vs registry-platform-httpsec split as principled but confusingly named; the decision is to keep that split and document the boundary rather than merge or rename.

Scope

1. Merge registry-platform-replay into registry-platform-cache as a module. Move, do not rewrite; update consumers and drop the crate.
2. Document the httputil vs httpsec boundary in both crates' crate-level rustdoc (what belongs where). Rename only if a one-paragraph doc cannot draw the boundary.

Acceptance

• Workspace builds with replay as a module of cache; no orphaned crate; consumers updated.
• Both HTTP platform crates state their boundary in crate-level docs.
• Replay behavior is covered by the existing tests, moved intact.

Security note

Replay protection is security-relevant; the merge must be behavior-neutral (code motion, not redesign) and needs review notes per AGENTS.md. If work surfaces a suspected vulnerability, report it per SECURITY.md, not on this issue.