fix(proxy): retire cooldown-suppressed HTTP bridge sessions

[hongzexin]

Summary

• Retire an HTTP bridge session when late retry-circuit cooldown suppression returns 503.
• Retire the startup pre-submit cooldown terminal path as well.
• Preserve the existing 503 envelope, Retry-After header, and no-upstream-send behavior.
• Add regression coverage and an OpenSpec change.

Fable5 analysis

Fable5 (claude-fable-5, response msg_l4vLQ0i8RzQiFjCGE2W7cOiE) evaluated the issue and found Strategy A (mark the session for retirement and use the existing bounded drain-retirement path after cooldown suppression) feasible with minimal risk. Strategy B would require broader request-admission plumbing and was not selected.

Validation

• Targeted unit tests: 3 passed in this checkout
• Earlier full bridge unit run: 681 passed; one unrelated fixture/environment failure (sqlite3.OperationalError: no such table: file_account_pins)
• Related integration tests: 3 passed
• Ruff format/check: passed
• make architecture-check: passed
• make typecheck: passed
• Strict OpenSpec validation for this change and affected specs: passed

Fixes Soju06#1943
Upstream issue: Soju06#1943

Source sidechat: 01a04718-7322-72d0-b4b3-8f5bb4581157
Recovered from: 2268f8c