Name the failing component when a relayed request does not reach the upstream

[aszarama]

Linear: https://linear.app/cortexio/issue/PPO-39/cross-project-x01-prove-the-vertical-slice-and-protocol-contract

Paired with cortexapps/brain-backend#17029 - the two halves of one contract. This
side emits the classes; that side reads them.

Why

The reflector had one failure class, AXON_DESTINATION_REJECTED, written only as
a response body. A caller cannot tell that apart from an upstream's own 403,
because both arrive as a body on the same path. Two other things that fail here
had no way to be told at all.

What changed

x-cortex-failure-class on the response. The existing body text stays, for
whoever is reading logs. The header is the machine-readable half. ModifyResponse
deletes any copy an upstream sets, so only components on this side can name a
class.

AXON_CREDENTIAL_FAILURE. A failing plugin previously logged and continued,
which left {{plugin:google-adc}} in the header value. That placeholder then
travelled upstream as the credential, and Google's refusal came back as an
authorization failure - the provider failure was invisible, disguised as the one
thing it is most important to distinguish from. Resolution now returns an error,
and serve() stops the request before it is dialed.

AXON_NETWORK_FAILURE. DNS, connection, and TLS failures land in the reverse
proxy's ErrorHandler. They are this agent's own network, not the upstream's
answer, so a caller retrying against an upstream that was never reached is the
wrong response.

Shape

ValueResolver.Resolve now returns (string, error). Header resolution moved out
of the Director - which has no way to fail a request - into proxyEntry.serve(),
so there is one path to the upstream and the provider runs once per request. The
resolved values travel to the Director by request context, the same shape
withDynamicTarget already uses. Tests that drove entry.handler.ServeHTTP
directly now call serve(), so they exercise the real path.

Verified

• go test ./... - the full agent suite, green
• Four new tests in reflector_failure_class_test.go: the class header on a
  destination rejection, a credential provider failing without the upstream being
  dialed, an unreachable upstream, and an upstream that tries to name a class
• Live, against the assembled stack in the paired PR - brain-backend,
  relay-dispatcher, snyk-broker, and this agent all running together:
  • a relayed request reached the upstream carrying the credential this agent minted,
    with neither the relay token nor a placeholder on it
  • no routing metadata reached the upstream
  • the upstream set x-cortex-failure-class on every response and none survived
  • a destination outside the origin policy came back 403 AXON_DESTINATION_REJECTED
  • with the identity source refusing to mint, the same request came back
    502 AXON_CREDENTIAL_FAILURE - where before this change it would have gone
    upstream carrying {{plugin:google-adc}} and returned a 401