test: cover empty custom-header presence mismatches

[jw-ond]

Motivation and Context

Related to #519, not a replacement for the reporter's positive empty-body /
empty-header acceptance case. This draft supplies complementary rejection
coverage in http-custom-header-server-validation:

• Empty argument with an absent header.
• Omitted optional argument with a present empty header.
• Null argument with a present empty header.

The old scenario passes the Go SDK before and after
modelcontextprotocol/go-sdk#1289. These checks detect
the pre-fix presence mismatch while still passing the fixed SDK. They require
HTTP 400 and JSON-RPC -32020 using existing requirement IDs and the normal CLI.

The selected tool's optional annotated string is preferred. If unavailable,
the omitted/null probes fail as untestable rather than appearing skipped/green.
The fixture requirement is documented in the scenario description.

No SDK implementation change, new scenario, dependency, check ID or traceability
edit is included. This is separate from #325's presence acceptance/required-
argument work and #555's standard-header error-code severity change.

How Has This Been Tested?

Pinned Go fixture, wire tests and reproduction instructions
are public so the real-SDK comparison can be rerun, not just taken from this
description.

• Four new real-HTTP tests fail on the unchanged scenario; all eight focused
  tests pass after the patch. Correct and deliberately broken presence fixtures
  are included, including the missing-prerequisite path.
• npm run check, npm run build, npm test: pass, 48 files / 645 tests.
• Real Go SDK parent 8075fb3cf313a11816340dcbdd7090d04a5a4b71 versus fix
  c04bc77a01ec33882c7e96ab957cc775cc2b0745:

Conformance build	SDK parent	SDK fix
Unchanged scenario	10/10, exit 0	10/10, exit 0
Patched scenario	12/16, exit 1	16/16, exit 0

Counts include wire-schema validation. The four failures are exactly the
status/code pairs for omitted/empty and null/empty. Fresh local reruns of the
suite, build/check and both patched native-SDK runs reproduce these results.

An additional real HTTP/1.1 + HTTP/2 wire matrix and SDK-client round trip passes
21/21 cases on the fix, with seven expected failures on its parent. Rejection
tests verify zero tool invocations. The fixed SDK's official empty-header and
name-encoding regressions also pass. These checks used official pinned SDK
archives, local module replacement and Go 1.27.2 with dependency checksums
enabled. The full Go SDK suite and native client conformance scenario were not
run. A null-without-header control isolates transport validation, not whether
null satisfies a string JSON Schema.

Compatibility

The added checks intentionally turn some previously green SDK runs red. The
omitted/null probes require an optional annotated string in the selected tool;
missing fixture support is reported explicitly. There is no runtime SDK API
change. Existing scenario discovery and required-argument defaults are not
expanded in this patch.

Review Status and AI Disclosure

Draft for coordination with #519 and contributor review, not a claim of
assignment or maintainer approval. It intentionally does not close #519.
Codex authored the scenario/test/fixture changes, executed local validation and
drafted this text and the issue comment. No prior human code review is claimed.