Custom Headers from customHttp.yml Missing on SPA Fallback Routes

### Before opening, please confirm:

- [x] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [x] I have removed any sensitive information from my code snippets and submission.

### Amplify Hosting feature

Custom headers

### Is your feature request related to a problem? Please describe:

When on a default 404 fallback rule `(`/<*>` → `/index.html`, status 404)` for SPA routing,
custom headers defined in `customHttp.yml` (e.g. Content-Security-Policy) are only
present on responses served directly from `/` (root).

Hard refreshing on any non-root route (e.g. `/app/settings`) serves `index.html`
content correctly, but the response is missing custom headers from
`customHttp.yml`.

This is similar to #621 where custom headers were confirmed to not attach on
301/302 redirect responses. The 404 fallback path appears to have the same limitation.

### Describe how you'd like this feature to work

Custom headers should apply on 404 fallback responses (as it's default behavior) the same way they do
on 200 rewrites. Right now Amplify's default SPA setup uses a 404 fallback,
which means any team relying on the default config silently loses their
security headers on every route except `/`.

Start with customHttp.yml and the default /<*> → /index.html fallback, reproducing the behavior on /app/settings and comparing its response headers with /. The issue names no implementation files or tests, so trace the hosting request path for fallback responses; done means configured custom headers appear on those responses.

Written by the indexing model from the issue text.