Add a shared request-timing collector and opt-in attachment middleware #446

Scope

Track the portable request-timing foundation implemented by #389, with downstream adoption in IABTechLab/trusted-server#1261.

• A generic RequestTimings<N, D> collector with one portable origin, bounded phase slots, snapshots, application-owned payload, saturating accumulation and drop-time spans.
• Explicit lifecycle marks for headers ready, request completion and response bytes.
• Opt-in, insert-if-absent attachment middleware that preserves an existing concrete handle and supports exact-path exclusions.
• Core, macro and adapter contract tests, plus documentation for application-owned timing boundaries.

Applications retain phase names, domain facts, rendering, header exposure and privacy policy. Attachment alone does not finalize requests, measure streamed-body completion or cover unmatched routes. Cloudflare and Spin request-extension hooks remain deferred.

Acceptance

• Review and merge feat(core): add shared request timing collector and middleware #389 with its documented API contracts and boundary limitations.
• Pass relevant core, adapter, macro, doctest and documentation checks against the revision being merged.
• Meet the PR's coordinated-delivery gate: update the Trusted Server consumer facade and all six dependency pins to one pushed candidate, confirm one resolved EdgeZero core identity and rerun joint validation.
• Keep deployed-provider clock qualification and any deferred work explicit. Local runtime tests do not establish deployed Cloudflare clock semantics.

The PR records detailed verification and remaining delivery gates. Trusted Server must replace temporary revision pins with an approved EdgeZero release tag and pass final tag-backed validation before its own merge.

Related to #120, which requests automatic request-latency capture and exposure. This issue covers the shared collector and attachment foundation, not automatic header or log output.