Remote pushes with invalid headers leave a stream dangling

When we receive a push promise, we first create the promised stream and then receive the frame. This is fine, but if receiving the frame produces an error (e.g. because the headers are invalid) then we never delete the stream again. That's no good.

Trace the push-promise handling path where the promised stream is created before the frame is received, then inspect the error path for invalid headers. Confirm that a frame-receive failure removes the promised stream, and add a regression test showing that no dangling stream remains.

Written by the indexing model from the issue text.