Add an exact transport fault proxy provider

## Problem

Playwright routing can exactly substitute payloads, delay requests, and remap hosts, but it cannot control HTTP framing or sockets. Treating shortened complete responses as disconnects would mislabel fidelity.

## Scope

- Implement a loopback-only disposable proxy provider for the generic `transport-fault-model/v1` contract.
- Support malformed/chunked framing, bandwidth pacing, connection refusal/reset, half-close, disconnect-after-N-bytes, DNS/host remapping, and request/response byte corruption.
- Preserve deterministic stateful sequences and counters across browser and server-side clients.
- Emit bounded redacted request/fault/response evidence.
- Negotiate each semantic as exact, emulated, or unsupported per backend.
- Guarantee proxy teardown after completion, cancellation, timeout, and provider errors.

## Acceptance criteria

- Protocol-level integration tests distinguish payload truncation from a true mid-stream disconnect.
- Browser and server-side clients consume the same fault declaration and replay schedule.
- Undeclared external hosts remain denied and the proxy cannot address arbitrary host services.

Refs #2014

Start by locating the generic transport-fault-model/v1 contract and the Playwright routing integration, then review how browser and server-side clients share fault declarations and replay state. Validate the provider with protocol-level integration tests covering true mid-stream disconnects, host denial, deterministic replay, bounded evidence, and teardown after every completion or failure path.

Written by the indexing model from the issue text.