[belowzeroff]

Summary

• track whether a Q connection is inbound or outbound before accepting RESPONSE frames
• reject RESPONSE frames sent to the server listener by ordinary clients
• deliver header-only RESPONSE frames to the waiting outbound sync caller as an empty protocol error instead of timing out
• add regression coverage for both frame-direction cases

User-facing behavior

Malformed peers now fail faster and more accurately: inbound server clients cannot keep using a connection after sending a RESPONSE frame, and attached outbound connections report empty responses as protocol errors rather than misleading timeout failures.

Testing

• git diff --check
• make recheck

Notes

This branch is stacked on top of the current open fix branches, because the upstream repository cannot target fork-only base branches. Until those PRs land, this PR shows the earlier stacked commits too.