Two fixes, both found by probing production

1. The Vary header shipped in #3688 was inert

#3688 set Vary in middleware believing that was "the layer that holds". It is not. Next overwrites vary on any app-rendered response (base-server.js setVaryHeader), so the value never reached a client.

So it is not that middleware headers are dropped. It is Vary specifically. The layer that works is a handler building its own Response, and both Markdown handlers already do. That is the direction that matters: the Markdown entry is the one a cache must never hand to a browser, and it is correctly keyed.

Residual, stated not hidden: the HTML entry carries only Next's RSC tokens, so a cache may serve stored HTML to a crawler. That degrades the bot-Markdown feature; it does not leak Markdown to readers.

2. Two advertised twins answered HTML on the bare URL

/pricing.md and /api-policy.md returned 200 with frontmatter and llms.txt advertised them, but mdTarget() did not know them, so a crawler asking for /pricing got HTML.

3. The test was the same bug, one layer along

#3688 replaced a config-grep with a response assertion, then asserted on middleware's own return value rather than the client's response. Green in unit-land, absent on the wire. A response assertion is only worth as much as the response you assert on.