runtime: complete SSE framing compliance

[samzong]

Problem

The runtime SSE parser handles CRLF, CR, and LF framing, but two WHATWG edge cases remain:

• A single optional leading UTF-8 BOM is treated as part of the first field name, so the first data or event field can be ignored.
• A pending event is dispatched at EOF even when no blank line completed the event; the standard discards that incomplete final event.

These are standards-compliance edge cases rather than failures observed in the current cloud.dify.ai smoke path, so they are tracked separately from #130.

Acceptance criteria

• Ignore at most one BOM at the start of an SSE stream.
• Discard an event that reaches EOF without a terminating blank line.
• Preserve CRLF, CR, and LF support and incremental live projection.
• Add focused parser tests for the two boundaries.

References

• WHATWG event stream grammar: https://html.spec.whatwg.org/dev/server-sent-events.html#the-event-stream-format
• Review finding: feat(runtime): collect streaming responses #130 (comment)