Native TLS proxy corpus: finish certificate rejection and S3 proxy parity

Scope

Finish exact native parity for js/bun/http/proxy.test.ts and remove its remaining corpus suppression without rewrites or skips.

Commit de6c192 restored standard RFC 7617 proxy Basic authentication and RFC 9110 failed-CONNECT handling. That reduced the exact untouched Home file from 42 passed / 5 failed to 45 passed / 2 failed.

Remaining production gaps

• A rejecting tls.checkServerIdentity callback must close the parked CONNECT tunnel promptly, reject with the callback Error, and transmit zero decrypted request bytes to the target.
• Bun.S3Client.stat must observe a runtime process.env.HTTP_PROXY assignment and remain safe when the env value is repeatedly overwritten while the request is in flight.
• The exact untouched js/bun/http/proxy.test.ts runs through the production VM corpus route.
• No source rewriting, compatibility shims, delegation, extra skips, or weakened assertions.
• Verify supported Linux and Windows targets once the macOS gate is green.

Current exact evidence

Pinned source SHA: aaecff631b75b1a8445e30330f3a63a9b3c8a5ddd3714273536e2638ae056de1

• Home after de6c192: 45 passed, 1 upstream skip, 2 failed, 171 assertions
• Pinned Bun 4982b91e3702094330f3be3883354c52b8c01323: 47 passed, 1 upstream skip, 0 failed, 177 assertions
• The two remaining Home failures each time out after 15 seconds.
• Stable home_rt gate: 1,816 passed, 19 skipped, 0 failed

Parent parity tracker: #66 Native suppression ledger: #202

Implemented and pushed the macOS production fix in f813c1d2b7e2d6fa0105a707726739f5ecd35b70 (fix(runtime): complete TLS proxy parity).

What changed:

• parks direct and CONNECT-tunneled TLS connections before any HTTP application bytes are written when checkServerIdentity owns the verdict;
• verifies an HTTPS proxy's outer certificate natively and reports only the target certificate to the user callback;
• resumes approved sockets on the HTTP thread and makes stale approval messages harmless after shutdown;
• closes rejected/invalid certificate paths promptly, including VM-shutdown cleanup;
• resolves the S3 stat proxy against the signed URL using live process.env, honors NO_PROXY, and owns the selected proxy bytes across concurrent env overwrites;
• restores the real S3 stat and main-thread task-dispatch bridges;
• removes the Home-injected TODO for js/bun/http/proxy.test.ts and routes it through the production VM.

Exact untouched source SHA: aaecff631b75b1a8445e30330f3a63a9b3c8a5ddd3714273536e2638ae056de1.

• Home: 47 passed, 1 upstream skip, 0 failed, 177 assertions
• pinned Bun 4982b91e3702094330f3be3883354c52b8c01323: 47 passed, 1 upstream skip, 0 failed, 177 assertions
• stable home_rt: 1,816 passed, 19 skipped, 0 failed
• debug production build, Zig formatting, diff check, and corpus-runner AST check: green

No source rewrite, compatibility shim, extra skip, or weakened assertion was added. The macOS runtime work is complete; this issue remains open only for its explicit Linux/Windows verification checkbox. Follow-up S3 facade work discovered during the fix is tracked in #597.

Fresh macOS verification at 4233b8c16732ec890518952f7045ab2a263e4a53 shows both previously listed production failures are resolved on current main:

• Debug strict native: 47 pass / 1 upstream skip / 0 fail / 177 assertions in 3.164 s.
• ReleaseSafe strict native: 47 pass / 1 upstream skip / 0 fail / 177 assertions in 2.874 s.
• Pinned Bun 4982b91e3702094330f3be3883354c52b8c01323: 47 pass / 1 upstream skip / 0 fail / 177 assertions in 2.44 s.
• Corpus source SHA remains aaecff631b75b1a8445e30330f3a63a9b3c8a5ddd3714273536e2638ae056de1.

The untouched native file now proves:

• rejecting tls.checkServerIdentity transmits nothing to the target and settles promptly;
• Bun.S3Client.stat observes runtime process.env.HTTP_PROXY and survives repeated overwrite while the request is in flight;
• non-200 CONNECT handling, TLS record order, socket reset, keep-alive partitioning, proxy headers/auth, redirects, and NO_PROXY behavior all pass.

No source change was needed in this verification turn because the production fixes and native routing are already present on main. I am leaving #596 open only for its explicit supported Linux/Windows verification item.