[tiptenbrink]

Removes repeated and wasted work from encoding S3 and Azure requests and reading their response heads. Each change is one commit, and no commit regresses: each was measured against the one before it (below).

S3 signing

• Sort the signed headers once per encode, not four times, and list the crate's own headers already in name order, so only a plan's extra headers are sorted in. Skip the merge with metadata when a request has none.
• Hash the canonical request from the head as written: the head is written once with a placeholder signature, and the signature is filled in afterwards. A head that does not fit its buffers is no longer signed.
• Write each signed S3 header as name:value after a \n from the one before, which the spans leave out. The signed headers are then the canonical request's lines, hashed in one or two pieces instead of four per header. An S3 head takes two more bytes per signed field; an Azure head is laid out as before.
• Buffer the ~30 small pieces of the canonical request in Sum, so the provider gets a few large updates.
• Keep the signing key's HMAC padding states for the day. API change: Sha256Provider::new takes start, update and finish, and the client builds HMAC-SHA256 itself. The Sha256 trait requires Copy and drops hmac. Sha256RustCrypto keeps its own state over sha2::block_api::compress256 and compresses blocks in place, and the crypto crate no longer depends on hmac.
• Sign x-amz-content-sha256, which the crate formats itself, without scanning it for spaces.
• Find . and .. key segments in one pass. Hex-encode digests from a table of digit pairs.

Shared

• Copy short slices into a request head with fixed-size moves instead of calls to libc's memcpy.
• Percent-encode a key using a table of 256 flags.
• Format decimal numbers two digits at a time, out of line. Inlined, the unrolled formatter made write_range about 2,400 instructions of machine code.
• WireRequest checks UTF-8 only in the part that url() or headers() returns.

Azure

• Check an Azure key's rules in one pass over its bytes instead of three. This was about half of encoding an Azure GET.

Response head

• ResponseHead::insert selects candidate names by length, then compares a name as two or three words with each letter's case bit set. In machine code it shrinks from 1,402 instructions to 204.
• Read a plain Content-Range (start-end/total) in one forward pass, and parse decimals of up to 19 digits without overflow checks. Anything else falls back to the general reading.

Measured with perf stat over a loop of each step: exact user-space instructions and cycles per call on a performance core, for the workload replay's ranged GET of an SST and a real Tigris answer to it:

step	master	this PR
S3 encode_get, ranged GET	15,271 instructions, 4,859 cycles	7,679 (−50%), ~3,060 cycles (−37%)
S3 response head (from_headers + accept_get_head)	2,632 instructions, 456 cycles	1,446 (−45%), ~380 cycles
Azure encode_get, bearer token of 1,826 characters	5,230 instructions, 1,189 cycles	2,543 (−51%), ~570 cycles (−52%)
Azure response head	2,681 instructions, 462 cycles	1,456 (−46%), ~370 cycles

Each commit was measured the same way against the one before it. Each lowers the instructions of the path it changes. On paths it does not touch, counts move by at most about 50 instructions, which is what builds of identical code show here: the CHANGELOG-only commits move them as much.

Checked:

• cargo test, clippy and docs with warnings denied, on the whole workspace with all features
• the no-allocator build
• object-tests offline grading: 1,126 pass, no mismatches against the expected list

The pinned SigV4 signature tests are unchanged, on both providers. CHANGELOG entries are under ## Unreleased.

[tiptenbrink]

Superseded by #52, which includes these 19 commits unchanged, followed by the templates work, as one PR.