[gael-obin]

The gateway formatted Core inspection failures with %v, so errors.Is lost the underlying refusal even though the request was rejected. Preserve both the Host edge sentinel and the actual Core cause using standard Go error wrapping. The HTTP response remains the same static 401 body, and invalid requests are not forwarded.

Classification: fix at the owning Host wrapper. Reuses Core decoding/inspection and the existing JWKS and gateway test helpers; no dependency or authority change.

Validation:

• Three real-wrapper regression cases fail before the patch and pass after it.
• Default gateway suite with Go 1.27.3, GOWORK=off, readonly modules and race detection: 714 passing test/subtest results; one explicit public-client-harness helper skip.
• Six HTTP refusal cases assert the exact status/body and no upstream request, covering malformed/foreign encoding, forged/expired capabilities, unknown key and unavailable JWKS.
• Vet, naming, boundaries and whitespace checks pass. Independent focused architecture, quick and Go elegance reviews found no blocker in this correction.

The unchanged full Core Inspector diagnostic now reports only the separate missing-route defect; it still fails overall. This PR does not close complete consumer conformance, Accounts test integration, release qualification or deployed acceptance. Track those in the existing qualification issue.

The separate installer/dependency repair remains independent. This PR targets current main and contains only the gateway wrapper/test changes; native CI for this candidate is pending. No publication or deployment is claimed.