Report unrecognized proxy error codes as unknown instead of dropping them

[archandatta]

Summary

• cdpmonitor publishes a proxy_error for every branded 502: an X-Kernel-Proxy-Error value outside the enum is reported as code: unknown with the sanitized header value in raw_code, instead of being dropped
• add restricted_route_unavailable and unknown to the code enum and raw_code to BrowserProxyErrorEventData; regenerate lib/oapi/oapi.go
• promote raw_code to the OTLP attribute kernel.proxy_error_raw_code
• table-drive TestProxyErrorE2E over a published code, a code published after the enum's first release, and an unrecognized value

Why

The metro egress proxy defines the header codes and deploys on merge. This image validates them against its compiled-in enum and rolls on its own cadence, so every code added on the proxy side is dropped here until the next image release. restricted_route_unavailable has never been in a released image, and origin_tls_timeout and provider_rejected landed in #385 a day after the image now in production was cut. For all three the session records a network_response with status 502 and nothing that names the proxy failure; the only trace is the dropping proxy_error with unknown code warning inside the VM.

Reporting unknown keeps the event and its request attribution while the enum catches up. raw_code is lowercased, restricted to [a-z0-9_], and capped at 64 bytes. The rate limiter keys on unknown rather than the raw value, so an origin that sets the header itself gets one slot per session and resource type, not a map entry per distinct string. kernel/kernel#4113 publishes the same two enum members and raw_code in the public spec.

Unchanged: the nine codes already listed are emitted exactly as before, the 502 gate and the per-session sampling interval are the same, and OTLP severity for proxy_error still depends on resource_type only.

Review note: this spec has no x-enum-varnames, so the generated constant for the new member is the bare oapi.Unknown. It compiles without collision today.

Testing

• go test ./lib/cdpmonitor/ ./lib/events/... — passes (~45s); includes the new TestSanitizeProxyErrorRawCode, the rewritten proxy_error_unknown_code_reported_as_unknown subtest, and the new proxy_error_raw_code OTLP subtest
• KERNEL_CDPMONITOR_CHROME_E2E=1 go test ./lib/cdpmonitor/ -run TestProxyErrorE2E — 3/3 subtests pass against a real Chromium
• go vet ./lib/cdpmonitor/ ./lib/events/ — clean
• go mod tidy removes ~300 stale go.sum entries on main; that drift is left out of this PR

🤖 Generated with Claude Code