fix(metrics): stop reclassified connections from polluting HTTP metrics

[mayankpande88]

The bug

A connection the parser gave up on kept being reported as an HTTP request for the rest of its life.

trackParseFail sets conn.protocolOverride = protocolReclassified (0xFF) once a connection has failed to parse parseFailThreshold times consecutively — the agent concluding eBPF misidentified it. 0xFF matches none of the 14 protocol cases, so every later event fell into default::

observe(r.Protocol, "unknown", "", "", 0, ...)

Two problems in that one call:

1. It still emits. Reclassification means we established the protocol is not what we thought. Continuing to report is worse than reporting nothing.
2. It passes r.Protocol, not the override — the original, wrong protocol. observe() maps HTTP2 → HTTP, so a Postgres connection misdetected as HTTP/2 incremented container_http_requests_total on every event, with a literal "unknown" status and zero duration.

Measured on dev

External "HTTP requests"	1.24M/hour
With status="unknown"	99.7%
From 3 private IPs (Postgres + egress proxy)	97%

Real external HTTP traffic was outnumbered roughly 400:1 — GitHub's 2,951 requests against 1.2M of noise. That is why status codes looked unusable in aggregate, and why external HTTP request counts were meaningless.

Why traces were unaffected

Trace data quality was near-perfect over the same window — 1 bad row in 31,900 spans — because default: only calls observe() and never creates a span. The pollution was confined to metrics. That discrepancy is what led to the cause.

Fix

Reclassified connections emit nothing. Genuinely unhandled protocols still reach default: and are counted under their own protocol, which is correct there precisely because it is not the sentinel.

Testing

No unit test. The containers package is excluded from CI (go test $(go list ./... | grep -v '/containers$')) and cannot be built on macOS, so there is nowhere for one to run. gofmt and GOOS=linux gopls check clean; full CI suite passes.

Verification is the deployed metric: container_http_requests_total{status="unknown"} should collapse from 1.24M/hr to near zero, and external HTTP counts should become dominated by real traffic.

Note on scope

This is a reporting bug, not a detection bug. The reclassification machinery was working correctly — it identified these connections as misdetected. It just did not stop them being counted.

[gemini-code-assist]

Code Review

This pull request introduces a protocolReclassified case in onL7RequestWithResult to suppress reporting stats for connections where the protocol was misidentified, preventing skewed metrics. The reviewer points out that when a connection is reclassified, associated parsers are not cleaned up, which could lead to memory leaks on long-lived connections, and provides a code suggestion to clean them up in trackParseFail.