Overriding a header for route `/` in the `_headers` file does not work

### What versions & operating system are you using?

```
System:
OS: macOS 26.5
CPU: (10) arm64 Apple M5
Memory: 3.07 GB / 24.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 24.16.0 - /Users/x/.volta/tools/image/node/24.16.0/bin/node
npm: 11.16.0 - /Users/x/.volta/tools/image/npm/11.16.0/bin/npm
npmPackages:
wrangler: ^4.95.0 => 4.95.0
```

### Please provide a link to a minimal reproduction

Repository: https://github.com/valtlai/workers-header-override-repro

Live version: https://workers-header-override-repro.valtlai.workers.dev/

### Describe the Bug

Look at the following `_headers` file:

```
/*
Content-Security-Policy: default-src 'none'

/
! Content-Security-Policy
Content-Security-Policy: default-src 'none'; script-src 'sha256-zSWYYPw1xOaTZBuoVtVHh6zo3hJOLC41SBglOn/7Fcc='

/other
! Content-Security-Policy
Content-Security-Policy: default-src 'none'; script-src 'sha256-OIvwVg2U6B8i0Bl3OYolZkIjKvc2y98ki39BpHOFoAo='
```

The first rule is the default CSP. The other two rules first remove the CSP and then set a new CSP, effectively overriding the default CSP for the route.

For `/other` this works as expected: there are only one CSP header, the one specified for `/other`.

But for `/` a new header is added, but the original header is not removed, resulting two CSP headers. This prevents the script from loading in browser.

It’s expected that the header rules work the same way for all routes, whether it’s `/` or any other.

The following CLI commands can be used to compare CSP the headers between two test pages:

```
curl -I https://workers-header-override-repro.valtlai.workers.dev/
# -> Two CSP headers
```

```
curl -I https://workers-header-override-repro.valtlai.workers.dev/other
# -> One CSP header
```

Note that the issue doesn’t show up when using `wrangler dev` – a deployment is required to reproduce.

### Please provide any relevant error logs

_No response_