h2c is deprecated, and the fix needs an http.Server that does not exist yet #689

Epic: #449

golang.org/x/net/http2/h2c is deprecated. pkg/op/server/router.go:101 uses it:

return h2c.NewHandler(mux, &http2.Server{})

The deprecation notice says to "set the [http.Server] Protocols field to use unencrypted HTTP/2 instead."
That cannot be done at this call site. Router.Handler() returns an http.Handler and has no server to set
the field on — and measured 2026-08-26, Handler() has no callers anywhere in pkg/ or cmd/, and nothing
in the tree constructs an http.Server around it.

So the control-plane HTTP surface is built but unwired, which is consistent with #500's framing of step 36's
fused first cut.

Why it surfaced now

go get golang.org/x/tools for #677's claim checker upgraded x/net transitively, and the newer version carries
the deprecation. The code did not change; the warning is new. It would have arrived at the next x/net bump
regardless.

Suppressed, not fixed

router.go:101 now carries //nolint:staticcheck // SA1019 with the reason above, so the gate stays green
without hiding the fact.

The fix belongs with the wiring

Whoever constructs the http.Server for the control plane sets Protocols there and drops both the h2c
wrapper and the suppression. Doing it before that means inventing a server to hold a field.