new capacity bits (#67)

tests/fixtures/header_injection/php/safe_set_header.php

@@ -0,0 +1,10 @@
+<?php
+// Safe: $_GET['lang'] routed through the project-local `strip_crlf` helper
+// before concatenation.
+function strip_crlf($raw) {
+    return str_replace(["\r", "\n"], ["", ""], $raw);
+}
+
+$lang = $_GET['lang'];
+$safe = strip_crlf($lang);
+header("X-Lang: " . $safe);

tests/fixtures/header_injection/php/unsafe_set_header.php

@@ -0,0 +1,6 @@
+<?php
+// Unsafe: $_GET['lang'] concatenated into a `header()` line.  The bare
+// `header` matcher (exact-match sigil) fires on the call.  Tainted input
+// without `\r\n` stripping permits response splitting.
+$lang = $_GET['lang'];
+header("X-Lang: " . $lang);