Per-pipeline middleware, composed once at Bind

[dangra]

A pipeline can now declare its own middleware chain. pipelinedef.Config.Middleware carries it, and the generated constructor takes it as an option — NewXxx(h, opts ...Option), with the generated package's WithMiddleware (an alias of pipelinedef.WithMiddleware, so wiring code never imports pipelinedef) the first option, since the middleware is optional:

deploy, err := deploypb.NewDeployService(&deploy{w}, deploypb.WithMiddleware(notFoundIsPermanent)).Bind(eng)

• Scope: wraps only that pipeline's operations, forward and unwind alike (Invocation.Phase distinguishes). A rule that belongs to one pipeline — the flyd stop port's "a store not-found ends any forward operation as a permanent failure" — no longer reaches every pipeline bound to the engine, and no longer needs a PipelineID string compare on every attempt.
• Order: engine middleware outermost, then the pipeline's own in declaration order (first listed outermost), then the handler: engine[0](…engine[n](pipeline[0](…pipeline[m](h)))). A tracing span installed on the engine wraps a pipeline's rules.
• Composed once at Bind. boundStep carries each step's composed forward and unwind operations; the per-attempt wrap and the unwind closure invokeUnwind allocated are gone. Wrapper factories run once per step and phase, the inner handler once per attempt, so invariant 71 holds and durableotel.Middleware is unaffected. The engine chain is final by Bind: options apply only in engine.New.
• Bind rejects a nil middleware entry. Per-step middleware stays out of scope; a pipeline middleware switching on inv.StepID() covers it.

Spec: 04-engine Middleware section gains the pipeline level and the composition line; invariant 119; http-analogy gets the "wrapping at mux registration" row (and its stale XFunc row fixed); 05-codegen and 02-authoring show the constructor option, and 02-authoring's stale positional-constructor sections are brought to the one-implementor form. README and tour observability sentences mention the per-pipeline form.

Tests: scope and order across two pipelines on one engine (engine/p1/p2 onion on one, engine alone on the other, forward attempts and unwind); the flyd case (one pipeline's not-found is permanent, the other's retries); factories run once at Bind regardless of attempts; Bind rejects a nil entry; New copies the slice; a machines example test passes middleware through the constructor option.

Perf gate (3 interleaved slices vs master): zero regressions; allocs and bytes within ±1%.

Additive for hand-rolled definitions; generated packages regenerate (the constructor gains an options variadic, existing call sites compile unchanged).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.