natsmsg: strip publish-control headers from the dead-letter copy

DeadLetter copied ALL of the original's headers onto the DLQ publish, including JetStream's publish-control headers. Those are instructions to the broker about the publish and are evaluated against the stream being published TO, so on the DLQ they are asserted about the wrong stream — false by construction.

The consequence was not cosmetic. An original carrying Nats-Expected-Stream naming its own stream failed the capture publish with err 10060 on EVERY delivery, so the message rode the full ladder and ended as OutcomeStranded with the ack floor still pinned. The breaker did not help: it terminates through the same capture, so it was defeated identically. One producer setting one header defeated the "never drop, never strand silently" guarantee for its whole class of messages.

Stripped: Nats-Expected-Stream, Nats-Expected-Last-Sequence, Nats-Expected-Last-Subject-Sequence, Nats-Expected-Last-Subject-Sequence-Subject and Nats-Expected-Last-Msg-Id, plus Nats-Rollup — which is worse than a failed publish, since honoured on the DLQ it would purge the subject the DLQ exists to retain. The -Subject variant is inert once its partner is gone, but it is a broker directive and none of them belong on the copy.

Nats-Msg-Id is deliberately KEPT, and the reason is now written down rather than left to inference: it is a dedupe key, not an assertion about stream state, and it is what makes the deliberate re-capture idempotent. When the DLQ publish succeeds but the original's Ack does not, settle:dlq_ack_failed prefers a duplicate in the DLQ over a pinned floor; inside the DLQ stream's duplicate window that second publish collapses onto the first instead of leaving a replay tool two copies to reconcile.

The regression test would pass on the broken code if the fake publisher ignored expectations, so it no longer does: it checks Nats-Expected-Stream against the stream it stands in for and refuses a mismatch with err 10060, exactly as the broker does. Against the pre-fix code the test fails with that same error.

Refs ENT-1601, ENT-1535.