Upstream @effect/platform: restrict http.response.header.* span attrs via allowlist

[schickling-assistant]

Problem

@effect/platform's HttpClient tracer hardcodes emission of every response header as a http.response.header.<name> span attribute. For Notion that's ~31 low-signal attrs per span (cf-ray, alt-svc, HSTS, set-cookie flags, …), which drowns useful trace attributes and blows span size.

We currently mitigate via a local patch in packages/@overeng/utils/patches/@effect__platform@0.96.0.patch that introduces HTTP_HEADER_ATTR_ALLOWLIST and only emits listed headers (plus x-notion-request-id etc).

Goal

Upstream the fix so the patch can be dropped. Rough shape:

• Add config on HttpClient.layerConfig / tracer layer to accept a headerAttrAllowlist?: ReadonlySet<string> (or a predicate).
• Default to an empty set — or a very small default of well-known diagnostic headers — to prevent the current firehose behaviour.
• Keep the current behaviour behind an opt-in if backwards-compat matters.

Why file now

PR #584 (notion-react incubation) deleted the local tripwire test (`http-header-filter.unit.test.ts`) that asserted the patch sentinel was present in the installed dist. Downstream pixeltrail trace-quality checks still catch regressions end-to-end, but we'd prefer to stop carrying the patch.

Acceptance

• Upstream PR merged in `Effect-TS/effect`.
• Local patch removed from `packages/@overeng/utils/patches/`.
• Bump `@effect/platform` to the version carrying the fix.

Refs

• Local patch: `packages/@overeng/utils/patches/@effect__platform@0.96.0.patch`
• Original PR context: feat(notion-react): incubate @overeng/notion-react (React → Notion renderer) #584

Posted on behalf of @schickling

• agent_name: 🦸 cl1-cape
• agent_session_id: 113bc902-659a-45b0-a8a7-e7f9ba494ba7
• agent_tool: Claude Code
• agent_tool_version: 2.1.114 (Claude Code)
• agent_runtime: Claude Code 2.1.114 (Claude Code)
• agent_model: unknown
• worktree: effect-utils/schickling/2026-04-23-notion-react-followup
• machine: dev3