…#1108)

Adds 6 new TEST_F cases to tests/unit/http2_client_branch_test.cpp that
compose mock_h2_server_peer (Phase 2A/2A.2/2E substrate) with the Phase
2E frame_injector (PR #1105) to drive previously-unreachable error
branches in src/protocols/http2/http2_client.cpp.

The Round 1 sub-issues of #953 (#991, #1062) raised happy-path coverage
on http2_client.cpp but left the file at 18.8% line / 9.9% branch on the
2026-05-06 develop measurement (run 25430202846). Round 1 closed before
the frame_injector substrate existed, so error-path branches that
require deterministic server-side frame faults could not be exercised.

This change opts each new TEST_F into one of five injection_mode values:

- DropFirstServerSettingsLeavesClientUnconnected
    injection_mode::drop on the first server-originated frame; client
    handshake never completes, exercising the connect-timeout branch
    that was previously only reachable via DISABLED integration tests.

- TruncatedServerSettingsHeaderTimesOutConnect
    injection_mode::truncate at 4 bytes; client receives an incomplete
    9-byte frame header and waits indefinitely, exercising the
    short-read / partial-header branch in the read loop.

- MalformedServerSettingsTypeByteTriggersConnectTimeout
    injection_mode::malform XOR=0x0F on the type-byte (offset 3); turns
    SETTINGS into an unknown frame type (0x0B), exercising the
    process_frame default / unknown-type dispatch branch.

- MalformedServerSettingsStreamIdNonZeroIsProtocolError
    injection_mode::malform XOR=0x01 on the last stream-id byte
    (offset 8); turns SETTINGS frame stream_id from 0 to 1, which is a
    PROTOCOL_ERROR per RFC 7540 §6.5, exercising the connection-error
    branch in handle_settings_frame.

- SlowWriteServerSettingsStillCompletesHandshake
    injection_mode::slow_write step=500us; positive test that the
    accumulating-buffer / partial-read branch in the read loop still
    completes the handshake when bytes arrive byte-by-byte.

- EchoOneTruncateAtNineDropsResponsePayloadFailingGet
    injection_mode::truncate at 9 bytes combined with reply_mode::echo_one;
    SETTINGS exchange completes (empty SETTINGS frames are exactly 9
    bytes so truncate_at=9 is a no-op for them) but response HEADERS
    and DATA frames lose their payloads, exercising the request-error
    / timeout branch on the connected path.

No src/ changes. Default injection_spec{} (== injection_mode::none) on
mock_h2_server_peer preserves Phase 2A/2A.2 behavior for all existing
TEST_F call sites that do not supply a spec.

Local verification: build clean, 4/6 new tests pass on macOS Apple
Silicon with the same pre-existing hermetic-handshake instability that
was observed and documented in PR #1105. The 2 tests with positive
is_connected() assertions fail locally for the same environmental
reason that fails the unmodified develop-tip baseline test
ConnectCompletesSettingsExchangeWithMockPeer on this machine. CI on
Linux + GitHub macOS runners is the authoritative verification surface.

Part of #1106
Part of #953

…1118)

Round 2 of grpc/client.cpp coverage expansion using the Phase 2 substrate
(frame_injector + mock_grpc_server_peer) merged in PR #1105. Round 1
sub-issues #994/#1063 raised happy-path coverage but client.cpp remained
at 22.6% line / 9.5% branch on run 25430202846 because error branches
require malformed/dropped/truncated/slow byte streams.

New TEST_F cases (all gRPC analogues of #1106 http2_client patterns):

- DropFirstServerSettingsLeavesGrpcClientUnconnected
  injection_mode::drop on server SETTINGS strands the underlying h2
  handshake; grpc_client::is_connected() never flips true.

- MalformedServerSettingsAckTypeByteBlocksGrpcConnect
  injection_mode::malform with offset 3 / xor 0x0F flips frame type
  byte (0x04 -> 0x0B) so the client drops the unknown frame and
  cannot complete the SETTINGS exchange.

- TruncatedServerSettingsHeaderBlocksGrpcConnect
  injection_mode::truncate with truncate_at=4 leaves a partial
  9-byte HTTP/2 frame header on the wire, driving the partial-read
  branch in the underlying http2_client.

- NonOkGrpcStatusTrailerDispatchesGrpcErrorBranch
  new grpc_reply_mode::echo_unary_error_status emits the same
  HEADERS+DATA reply as echo_unary but the trailing HEADERS frame
  carries grpc-status: 14 (UNAVAILABLE) and a grpc-message entry,
  driving the grpc_status != ok dispatch in call_raw.

- TruncateAtNineDropsResponsePayloadFailingCallRaw
  injection_mode::truncate with truncate_at=9 is a no-op for the
  9-byte SETTINGS frames so the handshake completes, but the longer
  response HEADERS / DATA / trailers frames lose their payloads;
  call_raw resolves with an error.

- SlowWriteServerFramesStillCompleteHandshake (gated outside
  coverage build) drives the partial-read accumulator branch by
  pacing the server SETTINGS write byte-by-byte.

Substrate addition (tests/support only):
  grpc_reply_mode::echo_unary_error_status — emits trailers with
  grpc-status: 14 + grpc-message: peer-unavailable. Pure
  test-support extension; no production source files modified.

Acceptance: 5+ TEST_F cases covering the issue's required injection
modes (drop/malform/truncate/non-OK trailer/slow_write).

Part of #953
Closes #1107