Preserve JSONRPC request IDs and correctly parse bounded multi-header frames

Read request dispatch and framing in crates/pet-jsonrpc/src/server.rs, then reply serialization in crates/pet-jsonrpc/src/lib.rs; start with the injectable reader/writer seam from dependency #529. Add deterministic cases for fragmented and coalesced frames, IDs, malformed input, and size limits, using existing fuzz/property tooling where practical. Done means IDs round-trip, framing remains compatible, and invalid input cannot panic or lose requests.

Tracking plan: #528
Priority: P2. Evidence: reproduced on Windows at 4e523ba.

Problem

The transport/dispatcher assumes a single Content-Length header, treats non-u64 request IDs as notifications, and narrows u64 IDs to u32. A bounded harness sent a valid control info request before each case and observed:

Sources: request dispatch, framing, reply serialization.

The payload length is also used directly for allocation without a documented upper bound.

Scope

• Parse framed headers through the blank line; support optional Content-Type and partial reads without losing subsequent frames.
• Represent supported request IDs without truncation across dispatch, refresh joiners, replies, and errors. Distinguish absent IDs from invalid IDs and valid string/numeric IDs.
• Validate protocol messages and frame size, returning appropriate explicit errors or a documented connection-close outcome where framing cannot be recovered.
• Update the documented supported JSONRPC/framing contract rather than silently broadening or narrowing behavior.

Acceptance criteria

• String and large integer request IDs round-trip unchanged, including coalesced refresh replies and errors.
• Tests cover extra headers, consecutive frames, fragmented header/payload reads, non-ASCII payload byte lengths, and clean/truncated EOF.
• Malformed JSON, invalid request shapes/IDs, invalid lengths, and oversized frames cannot panic, trigger unbounded allocation, or silently lose a request.
• Existing VS Code-style clients and environment/manager notifications remain compatible.
• Fuzz/property-style parser cases are added using existing tooling where practical; deterministic regression cases are mandatory.

Dependencies

Depends on #529 to reuse its injectable reader/writer seam. The complete landing order is in #528. This is separate from the already-fixed stdout logging contamination in #341.