fix(application): HTTP/2 from_data writes a stale Length; zero-fill cut schema lists in core #2686

Found by the short-read audit, and confirmed by an independent re-probe.

Regression from #2666, unreleased. HTTPv2._make_data now passes frame_length from the parsed Length for every frame. Edit a whole frame's data model and from_data:

• If the rebuilt frame is shorter, it writes the stale Length.
• If it is longer, it raises ProtocolError.

Before #2666, it recomputed the Length.

Design. #2666 and #2662 handle a cut list with hand-rolled pieces: SettingPairListField and GroupRecordListField (each a ListField.unpack override), HTTPv2.make(frame_length=), and the _made_length side channel. The capture-cut record is the built-in one. What's missing is the zero-fill that FieldBase.unpack gives every other field: ListField with SchemaField items raises on a short buffer instead.

Fix:

• Give ListField with schema items the same zero-fill to the declared width, once in core.
• Remove both list subclasses and the frame_length and _made_length channels, so make() recomputes the Length as it does for DATA.
• If that cannot land in time, the minimal fix is to pass frame_length only when info carries __short_read__.

Both need regression tests that edit a whole frame and round-trip it through from_data(info.to_dict()).