adapter: port the FUT roster-update response, held to the live oracle's bytes

Next component in the migration order (Roster -> LSX -> UTAS). Adapter layer
only: no host, no runtime replacement, nothing armed.

The response is shaped as much by http.server.BaseHTTPRequestHandler as by the
oracle's handler code, so it is captured over the wire rather than reasoned
about:

  * HTTP/1.0 status line -- protocol_version is left at its default, so the
    reply is 1.0 even though the client asks for 1.1
  * send_response injects Server: and Date: BEFORE the handler's own headers
  * POST answers with headers only: the handler writes the body `if method ==
    "GET"`, so a POST advertises Content-Length: 67 and then sends nothing

That last one is preserved, not corrected. It looks like a bug, but "obviously a
bug" has been the wrong call before in this port, and a test now asserts it so a
future cleanup has to argue with something.

Date and Server are volatile and are MASKED in the fixture rather than dropped,
so their presence and position are still asserted. Server is additionally
recorded verbatim: it carries the container's Python version, so a drift away
from roster::ORACLE_SERVER fails a test instead of silently changing every byte
we emit.

generate_roster.py --check FAILS when it cannot reach the oracle rather than
passing, and mutation-testing the mutation harness itself caught two "surviving"
mutations that were really sed no-ops. With application verified, all four
mutations (header order, Content-Length, XML body, Connection) are killed.

openfut-adapter-fifa17/src/lib.rs

@@ -22,10 +22,13 @@
 //!
 //! * [`blaze`] — the Blaze/Fire2 RPC surface. Implemented, runtime validated.
 //! * [`redirector`] — the first hop's `<serverinstanceinfo>` response.
-//!   Implemented; TLS transport is still the host's problem and unresolved.
+//!   Implemented; runtime validated against the retail client.
+//! * [`roster`] — the FUT roster-update response, the last gate before the hub.
+//!   Implemented; not yet runtime validated.
 //!
-//! Still served only by the Python backend: LSX/Origin (`:4216`), roster XML
-//! (`:8081`), UTAS/RS4 (`:8099`) and POW/EASFC (`:8094`).
+//! Still served only by the Python backend: LSX/Origin (`:4216`), UTAS/RS4
+//! (`:8099`) and POW/EASFC (`:8094`). Roster XML (`:8081`) has an adapter here
+//! but no Rust host yet.
 //!
 //! **Nucleus (`:42131`) is deliberately not ported.** Instrumentation across
 //! every live session showed the client never dials it: the listener is bound,
@@ -66,5 +69,6 @@
 
 pub mod blaze;
 pub mod redirector;
+pub mod roster;
 
 pub use blaze::{Adapter, AdapterConfig, Session};