test: stabilize fetch fixtures and update JS tooling

[BartWaardenburg]

What changed

• update fallow to 3.5.0, oxfmt to 0.59.0, and oxlint to 1.74.0
• make the local fetch-test server consume complete HTTP request headers before responding
• add a deterministic regression test for partial request delivery
• document the approved design and implementation plan

Why

The JavaScript tooling had newer releases available. Windows CI also intermittently reset local fixture connections because the test server closed sockets while request headers remained unread. That could prevent the client from making the expected second request and leave the server waiting until its accept timeout.

The fixture now waits for the complete HTTP header terminator before responding. Production fetch behavior is unchanged, and no new runtime or test dependency is introduced.

Validation

• focused regression test verified red before the fix and green after it
• repeated fetch integration stress run
• pnpm check
• pnpm test
• direct dependency registry check

[codspeed-hq]

Merging this PR will not alter performance

✅ 188 untouched benchmarks
⏩ 76 skipped benchmarks¹

---

_{Comparing codex/update-js-stabilize-fetch-tests (967376f) with main (16e6092)}

Footnotes

1. 76 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩