[fhgffy]

Close the upstream connection when the HTTP CONNECT handshake fails. The dialer currently leaves it open after a write failure, an unreadable status line, or a rejected status, and ignores malformed response headers after a 200 response.

Return header parsing errors and close the buffered connection on every failed handshake. A successful tunnel still retains bytes buffered after its headers. Tests exercise each failure path and a successful tunnel with an immediate payload.

Validation (Go 1.27.2, Windows/amd64): go test -p 1 ./... -count=1, go vet -p 1 ./..., and go build -p 1 ./....