[BUG] Response transformer mutates response headers before validating body extraction

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-response-transformer/src/main/java/org/apache/shenyu/plugin/ai/transformer/response/AiResponseTransformerPlugin.java:359-371`
- description: In the decorator's inner `flatMap`, the code does `this.getHeaders().clear(); this.getHeaders().putAll(newHeaders);` BEFORE checking whether `newBody` is non-null. If body extraction fails (returns null), the else-branch returns the ORIGINAL body bytes but with response headers already replaced by whatever the AI emitted. Original `Content-Type`/`Content-Length` are gone.
- impact: Corrupted response headers (and Content-Length mismatch) on any AI transformation where body extraction fails.
- suggested_fix: Only mutate headers after both header AND body extraction succeed.
- confidence: High
- related_existing: none — SEC-9 covers gzip decompression in the same file, not this ordering bug.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Read shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-response-transformer/src/main/java/org/apache/shenyu/plugin/ai/transformer/response/AiResponseTransformerPlugin.java:359-371, focusing on the decorator's inner flatMap and its header/body extraction paths. Verify that a null body extraction leaves the original response headers and body unchanged, while headers are replaced only after both extractions succeed.

Written by the indexing model from the issue text.