Add an exact transport fault proxy provider

## Problem

Playwright routing can exactly substitute payloads, delay requests, and remap hosts, but it cannot control HTTP framing or sockets. Treating shortened complete responses as disconnects would mislabel fidelity.

## Scope

- Implement a loopback-only disposable proxy provider for the generic `transport-fault-model/v1` contract.
- Support malformed/chunked framing, bandwidth pacing, connection refusal/reset, half-close, disconnect-after-N-bytes, DNS/host remapping, and request/response byte corruption.
- Preserve deterministic stateful sequences and counters across browser and server-side clients.
- Emit bounded redacted request/fault/response evidence.
- Negotiate each semantic as exact, emulated, or unsupported per backend.
- Guarantee proxy teardown after completion, cancellation, timeout, and provider errors.

## Acceptance criteria

- Protocol-level integration tests distinguish payload truncation from a true mid-stream disconnect.
- Browser and server-side clients consume the same fault declaration and replay schedule.
- Undeclared external hosts remain denied and the proxy cannot address arbitrary host services.

Refs #2014

まず、汎用の transport-fault-model/v1 コントラクトと Playwright のルーティング統合を特定し、次にブラウザー側クライアントとサーバー側クライアントがフォルト宣言とリプレイ状態をどのように共有しているかを確認します。プロトコルレベルの統合テストで provider を検証し、ストリーム途中での実際の切断、ホスト拒否、決定論的なリプレイ、上限付きの証拠、そしてすべての完了または失敗パス後の teardown を対象にします。

索引モデルが issue の本文から書いたものです。