Port HTTP request-smuggling hardening corpus

Focused Bun parity tranche split from #66.

Current state:

• js/bun/http/request-smuggling.test.ts is byte-identical to ~/Code/bun
• Home currently rewrites the complete security corpus to one native TODO
• baseline: 0 active pass / 1 TODO

Scope:

• reject ambiguous and malformed Transfer-Encoding combinations
• reject TE + Content-Length and conflicting/empty Content-Length framing
• preserve valid duplicate Content-Length and valid chunked requests
• strictly validate chunk hexadecimal sizes, overflow, and CRLF terminators
• retain split-segment parser state across TCP writes
• prevent smuggled/pipelined requests from reaching handlers
• isolate headers and bodies between sequential requests
• return deterministic HTTP 400 responses and close unsafe connections
• keep the upstream fixture untouched and add a permanent exact-corpus regression

Acceptance:

• exact upstream fixture passes with zero failures/TODOs/unsupported cases
• adjacent h1spec, chunking, header, and Bun.serve corpora remain green
• complete home_test gate passes
• changes are implemented in shared behavior, without fixture-specific output shortcuts

Completed and pushed to main in 940db8764.

What landed:

• activated the untouched 59-case js/bun/http/request-smuggling.test.ts security corpus
• validates repeated and comma-separated Content-Length values as a complete set
• rejects empty, conflicting, nonnumeric, and unsafe Content-Length framing
• validates repeated Transfer-Encoding fields and requires exactly one final chunked coding
• rejects TE+CL ambiguity, duplicate/non-final chunked coding, empty TE, and illegal chunked parameters
• routes Node net.connect() clients for genuine Bun.serve endpoints through the persistent Bun socket parser
• preserves Node HTTP server CONNECT/upgrade handling by giving native Node servers precedence over their fetch shadow handles
• carries incomplete request bodies across writes and explicitly rejects body consumers when framing fails or the client disconnects
• retains strict chunk hex, overflow, CRLF, split-segment, pipelining, and header-isolation behavior
• restores synchronous delivery for already-fixed Response bodies while preserving promise/stream paths
• improves h1spec failures with case index plus timeout/status/socket outcome
• adds a durable exact-corpus Home regression

Verification:

• exact upstream security corpus: 59 passed, 0 failed, 0 unsupported, 0 TODO
• displayed focused HTTP matrix: 264 active passes, 0 failures, 0 unsupported, plus 2 explicit upstream TODOs in bun-serve-file
• h1spec wrapper passes all 40 internal raw HTTP vectors
• static-response stress: 34/34 passed
• async iterator streaming: 86/86 passed
• Bun.serve file matrix: 66 passed, 2 upstream TODOs
• chunked-transfer TCP: 11/11 passed
• Node CONNECT pipelined-head regression: 1/1 passed
• complete home_test gate: exit 0 after 20m39.31s; 1,136 total inferred from the immediately preceding aggregate, with 1,135 passed, 1 skipped, 0 failed
• Home and ~/Code/bun fixture SHA-256 match: b4f67c07db618ea34246bd10a4f2d1d30d7eef1d631e83be9b6f55544cc588ec

The first full gate caught the Node CONNECT shadow-handle regression at 1,134 pass / 1 skip / 1 fail. The routing precedence fix made the isolated CONNECT, h1spec, smuggling, and chunking suites green together before the clean full rerun. No upstream corpus files were modified.