Related to #82442. The CONNECT client-socket crash reported there was fixed by #82444; this PR covers the distinct HTTP upstream-response stream failure path.

This is the clean maintainer replacement for #88052. GitHub could not reparent the contributor fork branch after fixups, so that PR began showing unrelated main files despite the reviewed two-file tree.

What Problem This Solves

The debug proxy consumed upstream IncomingMessage bodies without an error listener. If an origin closed the connection after sending response headers, Node emitted a response-stream error that could become unhandled and crash the proxy.

The old candidate handler also tried to end the downstream response with the upstream error text. Once a 2xx status and partial body had already been forwarded, that would make a truncated response look complete and append diagnostic text to application data.

Why This Change Was Made

• Record upstream response-stream failures as inbound capture errors.
• Before downstream headers are committed, return a complete generic 502 Bad Gateway response with Connection: close.
• After downstream headers are committed, destroy the downstream response so clients observe an incomplete response rather than a valid partial 2xx body.
• Reuse the same terminal-response helper for request-level upstream failures, without reflecting upstream error strings to clients.
• Preserve current body-preview capture behavior and current managed-proxy policy.
• Preserve @SebTardif's contributor credit in the co-authored maintainer commit.

This follows Node's documented HTTP lifecycle: a premature upstream close after the response begins emits aborted/close/error on the incoming response, while destroying an outgoing response closes its socket. See the Node HTTP documentation.

User Impact

Broken origins no longer crash the local debug proxy. Failures before headers produce a truthful 502; failures after headers terminate the partial response; the proxy remains available for subsequent requests.

Evidence

• Exact reviewed head: 5ef0700be070b6bc1b5bb01fcc562f6e1d1cc23c.
• Sanitized AWS Crabbox run run_246cffe1bd2b, lease cbx_71a6b7c8518f, Node v24.15.0, public networking, no Tailscale, no instance profile.
• Command: pnpm test src/proxy-capture/proxy-server.test.ts src/proxy-capture/proxy-server.managed-proxy.test.ts.
• Result: 2 test files and 13 tests passed.
• Real-wire regressions prove a complete generic 502 before headers, an incomplete partial 200 after headers with no appended error text, capture-store error records for both paths, and a successful second request through the same proxy after each failure.
• Fresh exact-head autoreview will be recorded before merge.

The original contributor reproduction established the missing-listener crash surface. The maintainer rewrite preserves contributor credit and strengthens the client-visible contract and regression proof.

Original contributor PR: #88052.