speed(wrapper): zero-copy body decode on valid UTF-8 (S4)

Mirror the core downloader's from_utf8 fast path in the wrapper's net.rs so a
valid UTF-8 response (the common case) moves the buffer instead of the old
from_utf8_lossy().into_owned() double-copy; lossy fallback preserved for
mojibake. This straw commit also carries the strawcore Loop-3 speed pass
(move-not-clone playerResponse, overlapped sig-timestamp fetch, player.js copy
cuts) into the build via the CI's strawcore clone. Deferred wrapper follow-up:
S5 (opt-level=2 for the JS-interpreter crates in rust/Cargo.toml).

rust/strawcore/src/net.rs

@@ -80,9 +80,14 @@ pub(crate) async fn read_capped_body(resp: reqwest::Response, cap: usize) -> Opt
         }
         buf.extend_from_slice(&chunk);
     }
-    // Lossy decode: a strict from_utf8 would drop the whole response on a
-    // single mojibake byte; serde_json tolerates U+FFFD in string values.
-    Some(String::from_utf8_lossy(&buf).into_owned())
+    // Prefer a zero-copy move on valid UTF-8 (the common case); fall back to a
+    // lossy copy only on a mojibake byte (a strict from_utf8 would otherwise
+    // drop the whole response — serde_json tolerates U+FFFD in string values).
+    // Mirrors the core downloader's default_impl fast path (S4).
+    Some(match String::from_utf8(buf) {
+        Ok(s) => s,
+        Err(e) => String::from_utf8_lossy(e.as_bytes()).into_owned(),
+    })
 }
 
 // ---------------------------------------------------------------------------