fix(gateway): stop benching domains for our own cancellations; dedupe websocket health checks

[oten91]

Two independent gateway fixes found while diagnosing why one operator was receiving
no traffic on a batch-heavy service.

1. Circuit breaker benched domains for cancellations we issued

An endpoint cannot cancel our context — only we can — so context.Canceled is never
evidence about the endpoint. A genuinely slow endpoint surfaces as
context.DeadlineExceeded, which is a real signal and still breaks. The two were being
conflated.

An existing guard covered a cancel of the client's context. A second source went
straight past it: the hedge racer repoints the primary's protocol context at a detached
parent (detachedHedgeCtx + SetParentContext) and cancels that parent on every one of
its exit paths. When the race produced no usable response, the batch item fell through to
the normal request path and reused the same, now-dead, context — the relay failed
instantly with context canceled without ever reaching the endpoint, and that was stamped
on whichever endpoint happened to be primary.

Impact measured before the fix: one operator's endpoints were circuit-broken on 12–18 pods
near-continuously for six hours at a gate failure rate of 0.75%, while its traffic was
carried entirely by its second hostname.

Two changes:

• shouldCircuitBreak returns false for a wrapped context.Canceled. It lives in the
  shared decision function because MarkBroken has four callers and the invariant belongs
  to all of them.
• The hedge fallthrough builds a fresh protocol context instead of reusing the cancelled
  one, so the fallthrough actually sends.

2. Websocket health checks were not deduplicated by backend URL

HTTP checks were deduplicated per backend URL; websocket checks were explicitly not. A
backend carrying N supplier registrations took N full TCP+TLS+WS handshakes per cycle
where HTTP took one, so the cost tracked how a provider spread its registrations rather
than how much traffic it served. One operator was receiving roughly 3 handshakes per
second per gateway egress IP.

Now one handshake per distinct backend websocket URL, with the outcome recorded for every
supplier sharing that URL. Recording rather than skipping is load-bearing: a websocket
probe is a property of the backend, so a broken backend must move every sharing supplier's
websocket reputation key — otherwise only the probed supplier is penalized and the others
stay clean and selectable while fronting the same machine. The probing supplier rotates
with the cycle counter so each one's own path is still validated directly.

Also drops the text from the probe's close frame; the close code is what keeps these out
of an endpoint's error budget.

Testing

Both fixes revert-checked — the fix removed, the test confirmed failing, the fix restored.

• TestProcessSinglePayloadWithRetry_ClientCancelDoesNotFeedCircuitBreaker — the control
  case previously used context.Canceled with a live parent and asserted it should
  break, which is the exact production shape asserted as correct, so it could not separate
  a cancel from a real fault. Control now uses connection refused, with a new case
  covering cancel-with-live-parent.
• TestProcessSinglePayloadWithRetry_HedgeFallthroughRebuildsProtocolContext — asserts on
  call ORDER (build relay build relay), because a count alone passes on the buggy code:
  the race also builds a context for the hedge endpoint.
• Test_WebsocketCheck_OneHandshakePerBackendURL — five endpoints across two backend URLs
  cost two handshakes, with all four sharing suppliers still recorded.

Canary validation

Canary on this build, mainnet as control. Roughly ten minutes in:

• Zero context canceled breaks on canary across all services, in 25 captured break
  events. Before the fix, one operator alone produced 18 in fifteen minutes.
• On the affected service, canary recorded 1.06 breaks against mainnet's 5.29 over the
  same window, and mainnet is still breaking the operator that canary no longer breaks.
• Canary still produces deadline breaks, confirming the guard is not over-matching.

Note the websocket half is not observable in existing metrics:
path_health_check_status_total counts recorded results, and the fan deliberately keeps
one result per supplier, so the handshake reduction is real but invisible there. It is
covered by the unit test rather than by a production counter.