Reads already wait for END_STREAM when inflation applies, so keep the receive window open while the encoded body is buffered. This lets a gzip response larger than 65,535 bytes inflate instead of failing, and the split test now reads before the content length so it exercises the read path.
Each test serves its own CA_LIST.cer through the working-directory
override of the sandbox path. guest_ssl_system_roots checks that a
handshake to the fixture server fails without the helper and passes
with it, that a context authority still works alongside the list, and
that an empty or certificate-free list throws with its path.
guest_http2_system_roots sends a request from a context with no loaded
certificate, which passes only through the transport's helper call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Eduardo Ruiz