CSS domain commands (CSS.enable, CSS.getAllStyleSheets) hang with no response through Target routing

### Problem

Several CSS domain commands hang indefinitely when sent through the WebSocket proxy. The commands are forwarded to webinspectord but no response is ever relayed back. Worse, the hang corrupts the Target routing pipeline so all subsequent commands on the same connection also hang.

**Commands that hang:**
- `CSS.enable`
- `CSS.getAllStyleSheets`
- `CSS.getStyleSheetText`

**Commands that work fine:**
- `CSS.getMatchedStylesForNode`
- `CSS.getComputedStyleForNode`
- `CSS.getInlineStylesForNode`
- `CSS.setStyleText`
- `CSS.forcePseudoState`
- All other domain enables: `Debugger.enable`, `Canvas.enable`, `Animation.enable`, `Worker.enable`

### Reproduction

Connect via WebSocket, wait for `Target.targetCreated`, then send commands wrapped in `Target.sendMessageToTarget`:

```python
# pip install websocket-client
import json, time, threading, websocket

WS_URL = "ws://localhost:9222/devtools/page/1"
ws = websocket.create_connection(WS_URL, timeout=10)
target_id = None
pending = {}

def read_loop():
global target_id
while True:
try:
data = ws.recv()
msg = json.loads(data)
if msg.get("method") == "Target.targetCreated":
target_id = msg["params"]["targetInfo"]["targetId"]
continue
if msg.get("method") == "Target.dispatchMessageFromTarget":
inner = json.loads(msg["params"]["message"])
iid = inner.get("id")
if iid and iid in pending:
pending[iid]["result"] = inner
pending[iid]["event"].set()
except: break

t = threading.Thread(target=read_loop, daemon=True)
t.start()
time.sleep(1)

next_id = [1]
def send(method, params=None, timeout=5):
iid = next_id[0]; next_id[0] += 1
inner = {"id": iid, "method": method}
if params: inner["params"] = params
evt = threading.Event()
pending[iid] = {"event": evt, "result": None}
oid = next_id[0]; next_id[0] += 1
outer = {"id": oid, "method": "Target.sendMessageToTarget",
"params": {"targetId": target_id, "message": json.dumps(inner)}}
ws.send(json.dumps(outer))
if evt.wait(timeout):
return pending.pop(iid)["result"]
pending.pop(iid, None)
return "TIMEOUT"

# Works fine
print("Runtime.evaluate:", send("Runtime.evaluate", {"expression": "1+1", "returnByValue": True}))
print("Debugger.enable:", send("Debugger.enable"))
print("Debugger.disable:", send("Debugger.disable"))

# Hangs (no response, times out after 5s)
print("CSS.enable:", send("CSS.enable"))

# Connection is now corrupted. This also hangs:
print("Runtime.evaluate after CSS.enable:", send("Runtime.evaluate", {"expression": "2+2", "returnByValue": True}))

ws.close()
```

**Output:**
```
Runtime.evaluate: {"id": 1, "result": {"result": {"type": "number", "value": 2, ...}}}
Debugger.enable: {"id": 3, "result": {}}
Debugger.disable: {"id": 5, "result": {}}
CSS.enable: TIMEOUT
Runtime.evaluate after CSS.enable: TIMEOUT
```

### Environment

- iOS 17.2 (Simulator, iPhone 15 Pro)
- ios-webkit-debug-proxy 1.9.2
- macOS 15.5 / Xcode 26.3

### Notes

I understand iwdp is a transparent proxy that forwards messages verbatim via `_rpc_forwardSocketData`. The bug is likely in webinspectord or WebKit's InspectorCSSAgent when handling commands through the remote debugging path.