chore: Protect headers before flush

Ensures protected response headers are filtered before `Flush` commits them. This prevents origins from bypassing reserved-cookie and cache-control protections through early flushing.