test: probe branches, local upload errors, upstream errors, rpm/gc error paths

internal/proxy/engine_test.go

@@ -293,6 +293,21 @@ func TestBearerTokenFlow(t *testing.T) {
 	}
 }
 
+func TestFetchUpstreamError(t *testing.T) {
+	requireStack(t)
+	r := seed(t, genericRemote("eng-404"))
+	// Upstream 404 (no cached copy, stale-on-error can't help) -> ProxyError.
+	_, err := testEngine.Fetch(context.Background(), r, "missing", prov(t, models.PackageGeneric))
+	var pe *ProxyError
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusNotFound {
+		t.Errorf("expected 404 ProxyError, got %v", err)
+	}
+	// HEAD of a missing upstream path also errors.
+	if _, err := testEngine.Head(context.Background(), r, "missing", prov(t, models.PackageGeneric)); err == nil {
+		t.Error("expected head error for missing path")
+	}
+}
+
 func TestBearerTokenParsing(t *testing.T) {
 	// Non-Bearer challenges and missing realms are rejected.
 	if _, _, err := fetchBearerToken(context.Background(), "Basic realm=x", models.Remote{}); err == nil {