Record unledgered deviations and open decisions found outside a phase #69

Part of the audit remediation umbrella #67. Milestone 1. Severity: LOW. No behavior change.

Current SDK behavior

docs/deviations.md says its 2026-08-31 sweep "found no unrecorded deviation". The audit
found MUST-level narrowings and undecided readings that live only in phase specs, test
comments, or nowhere:

• IO-13: write-side encodings narrowed to UTF-8 and ISO-8859-1
  (packages/core/src/io/text-codec.ts:32-51; Phase 3a design :406).
• BODY-34: two-of-three coverage (Phase 3b design :447). BODY-9 (:441). IO-38 (Phase 3a
  design :400).
• CTX-15: noopInstrumentationBundle.activeSpan is undefined, not a no-op span
  (context/instrumentation.ts:65). The Phase 4a ledger deferred it until a Span type
  existed; NOOP_SPAN exists at observability/tracing.ts:47.
• PIPE-37: no implementation and no test. The Phase 4 checklist (:141) handed it to Phase 5;
  Phase 5 shipped without it. statusMappingStep is a ResponseStep, not a pipeline Step.
• PAGE-19: the spec's conformance example <not a url>; rel=next does not end the stream.
  WHATWG resolves it to a relative path (strategies.ts:115-120; strategies.test.ts:194-200).
• REDIR-3: eligibility uses the current hop's method, not the original request method
  (redirect/codes.ts:69, decide.ts:241). After an opted-in 303 rewrote POST to GET, a
  following 301 is followed under the default method set.
• HTTP-46: Request.equals compares body by identity (request.ts:137). Archived as blocked
  in the dissolution record; in neither §10 nor the register.
• The two transports differ on reasonPhrase (fetch sets it, undici cannot) beside the
  Protocol.HTTP_1_1 gap that §10 item 13 already ledgers.

Expected behavior

Each item above has one of three outcomes, written down:

• a row under "Deviations recorded outside a phase" in docs/deviations.md, dated, with the
  file:line evidence, or
• a decision to implement, tracked as its own issue, or
• a decision that the current reading is intended, pinned by a test that names the requirement.

Notes and leads

• CTX-15 is a one-line fix (activeSpan: NOOP_SPAN). Prefer the fix over a ledger row.
• PIPE-37 needs a decision from the maintainer: implement a PRE_REDIRECT status-mapping
  pipeline step, or ledger the gap. The petstore spike (examples/petstore/FINDINGS.md,
  finding 2) wants StatusErrorMap applied at the toHttpError site, which may be the same
  work.
• REDIR-3: the current reading is the security-conservative one under one interpretation.
  Decide, add a test with allow303: true, POST, 303 then 301, and record the reading in the
  Phase 5b ledger section.
• §10 is frozen. Rows go to deviations.md; §10 folds them in on its next deliberate edit.
• node .claude/skills/housekeeping/probe.mjs --only=citations after editing.