Cross-path feature flags need protocol, geometry, and physical-work invariants

COR-4082 integration review surfaced three reusable cross-service checks. First, extracting shared UI geometry can silently regress another scanner even when the new scanner is correct: preserve existing orientation caps and add regression cases for every consumer. Second, restrict new multipart/request variants at the profile boundary; otherwise an authenticated caller can activate experimental behavior under a standard profile whose semantics are corpus-gated. Third, a 300 ms Promise.race is only a latency budget, not a resource cap: non-cancellable native validation that loses the race must remain counted against an engine/request limit until it physically settles. These issues were found only in the full combined-diff review, after component-level tests had passed.