Keep Model Target allowance policy in the real adapter

[adamtheturtle]

The shared Model Target status helper currently recognizes the Vuforia hostname to skip allowance rejections and xfails those rejections at other URLs. This embeds real-account policy in the shared assertions and can hide an unexpected rejection from a mock.

Keep the shared status assertion strict by default, retaining the URL, status and body in its diagnostics. Add a typed, scoped response-handler operation for adapters. Only the real Model Target adapter installs the allowance handler, preserving its skip reason and supporting supplied URLs without hostname inference. Expected error statuses still pass, and unrelated failures still raise.

Part of #3738.

Validation:

• Both existing mock adapters and affected Model Target/core tests: 540 passed, 244 skipped, with real-service execution disabled.
• Seven permanent adapter-policy cases exercise the public real setup fixture with synthetic responses, canonical/custom URLs, expected quota statuses, unrelated failures, teardown cleanup, and nested handler restoration. These make no live requests or credential lookups.
• Independent consumer: 7 passed, reusing shared assertion tests and supplying its own policy with native-adapter, Flask and settings-loader imports blocked.
• Isolated baseline collection preserves all 2,823 unaffected cases. One allowance-helper case expands to two URL cases and seven policy cases are added; 2,832 cases collect in total.
• 100% coverage for the policy module, policy tests, changed shared assertion tests and the status assertion function; every added executable adapter line covered. AST comparison preserves other shared assertions and adapter functions.
• Pre-commit/pre-push checks, strict type checking, CI partition and manifest validation, changed-file Pylint, and git diff --check.