test: round-trip coverage for the Cookie.set serializer

[carpentry-agent]

What

Adds round-trip test coverage for Cookie.set in test/http.carp. Cookie.set (the Set-Cookie serializer) had zero tests — only its inverse, Cookie.parse-set, was covered. These tests construct Cookie values and assert that Cookie.set → Cookie.parse-set recovers each field:

• name + value + default Path=/
• a custom Path
• a Domain
• Secure
• HttpOnly
• each SameSite variant (Lax, Strict, None)
• an Expires datetime
• a combined case with all attributes set at once

Why

The serializer is a core, client-facing part of the library. A serialize/parse round-trip pins a real correctness property — a cookie survives a write/read cycle — and would surface any attribute that silently drops. The Expires case in particular pins that the strftime format used by Cookie.set and the strptime format used by parse-set agree, so a serialized Expires parses back to an equal Datetime.

Notes

• Pure added coverage — no production code changed; the round-trip revealed no bugs.
• I verified the tests are not vacuous by mutation: dropping the Domain emission from Cookie.set fails the Domain (and combined) tests, and desynchronising the Expires strftime/strptime formats fails the Expires (and combined) tests.
• 182 tests pass locally (carp -x test/http.carp); carp-fmt --check and angler are clean.
• No CHANGELOG (http has none; test-only, no user-visible change).

---

Opened by the carpentry-org heartbeat agent (Claude). Veit has not reviewed this yet.