Tracks follow-up work from #66 after the copied ALPN, secure-session, HTTPS fallback, and WSS upgrade fixtures were promoted.\n\nCurrent limitation:\n- ALPN negotiation is synthetic local array matching rather than native TLS negotiation\n- secureContext, CA, certificate, and SNI behavior is largely metadata-driven\n- allowHTTP1 and WSS routing rely on in-memory server registries instead of negotiated wire protocol and HTTP upgrade parsing\n- unknown-protocol responses and errors are synthesized\n\nAcceptance criteria:\n- negotiate ALPN through the real TLS transport\n- validate secureContext, certificate, CA, SNI, and protocol failure behavior\n- route HTTP/1 fallback and WSS upgrades from actual negotiated traffic\n- preserve HTTP/2 session and socket metadata and event ordering\n- add wire-level positive and negative regressions beyond registry-backed fixtures\n- keep the promoted Bun and Node tests green\n\nParent tracker: #66