test: reject arbitrary-port routing failures

[Flandern (Flandern1211)]

Fixes #1102

Summary

The arbitrary-port E2E test previously treated every non-200 response as a successful rejection. That allowed upstream routing failures such as HTTP 503 or 504 to pass the test.

Require the expected 502 Bad Gateway response emitted by atunnel instead, so the test only passes when the unlisted actor port is actually rejected by the actor ingress path.

Validation

• go test ./internal/e2e/suites/networking -run '^$' -count=1 — passed (package compilation)

• go vet ./internal/e2e/suites/networking — passed

• go test ./internal/atunnel -run '^TestServeHTTP' -count=1 — passed

• Full Linux test suite, root-gated tests, and gVisor/microVM E2E — delegated to GitHub Actions because this workstation is Windows without Docker/KinD

• Tests pass

• Appropriate changes to documentation are included in the PR (no documentation changes are needed for this test-only fix)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Flandern (Flandern1211)]

I signed the Google CLA and triggered the New Contributors rescan. The cla/google check is currently pending; please let me know if maintainer-side approval or a further rescan is required.

[NekoPunch (orangeCatDeveloper)]

We already have https://github.com/agent-substrate/substrate/pull/1103/changes. This PR is duplicate please close it