bug: combined-site consumer gateway returns 500 for invalid requests #348

Bug

In the combined-site Kind qualification, invalid requests sent through the consumer gateway return HTTP 500:

• A request to /v99/nonexistent/endpoint returns 500.
• A request to /v1/chat/completions with malformed JSON (not-valid-json{{{) returns 500.

I haven't observed this failure with the other scenarios so I * think * it's the combined site topology. GLB keeps its edge and provider gateways in separate clusters. But static-weighted also has both gateways at provider-a, with provider gateways at the other sites.

In the same proof, a valid request returns 200 and an invalid model returns 404. The 500s are reproducible in saved combined-site qualifications, including evidence predating PR #332. This issue tracks the request behavior separately from the PR's test assertion.

Expected behavior

Invalid client requests should receive the appropriate client-error response, rather than an internal server error. Determine the intended status for each path (for example, 404 for an unsupported path and 400 for malformed JSON), then make the deployed consumer gateway return it consistently.

Evidence

• Combined-site CI run at Grid b716c589e3e0cf6161e29feef43874405a71aa7d: the negative_routing proof reports invalid_path_http_status: 500 and malformed_body_http_status: 500, despite an overall 29/29 pass.
• Probe implementation at that revision: requests target consumer-gateway.grid-system.svc.cluster.local:8080.
• PR #332 review discussion notes that the negative-routing proof can count a 5xx response as a rejection.

The recorded proof contains final HTTP statuses but does not identify which component generated the 500s. Please capture the response headers/body and relevant consumer gateway logs or traces while reproducing, then locate the source of the error. GLB's bogus-path check calls a provider gateway directly and gets 404; it does not establish the behavior of the combined-site consumer gateway.

Completion criteria

• Identify why the consumer gateway returns 500 for these two inputs.
• Return the intended client-error status for each input through the deployed combined-site path.
• Keep a Kind regression check that rejects unexpected 5xx responses and records enough response detail to diagnose future failures.

Related: #332, #344.