fix(runtime): fail closed on hemx request errors

Preserve pending recovery while making failed HTTP responses non-applicable as effects. The runtime now restores aria-busy with pending state and emits inspectable hemx:error details with HTTP status for failed requests.

req: runtime/005

req: convention/007

REQUIREMENTS.md

@@ -447,6 +447,9 @@ what a valid business email is.
 ### req: runtime/004
 004	Core runtime exposes a minimal version/fingerprint handshake only. Capability negotiation belongs to integration crates such as `hemx-wasm`, `hemx-sync`, and `hemx-transition`.
 
+### req: runtime/005
+005	Failed hemx HTTP requests must fail closed: non-2xx responses are not applied as effects, pending state is restored, and the runtime emits an inspectable `hemx:error` event with status when available. [north_star]
+
 ---
 
 ## failure
@@ -983,7 +986,7 @@ async fn delete(app: State<App>, todo_id: TodoId) -> impl IntoEffect
 006	Request concurrency policy (`latest`, `queue`, `drop`, `parallel`) may be declared per handle with `data-hemx-policy`. Default for debounced/input handlers is `latest`; default for form submit is `drop` while pending. Stale EffectBatches from superseded requests must not be applied.
 
 ### req: convention/007
-007	Pending indicators are cosmetic only. The runtime toggles pending classes, indicator visibility, and disabled controls around request/effect execution; handler semantics are unchanged.
+007	Pending indicators are cosmetic only. The runtime toggles pending classes, `aria-busy`, indicator visibility, and disabled controls around request/effect execution; handler semantics are unchanged.
 
 ### req: convention/008
 008	`data-hemx-disable-while-pending` disables the triggering form controls or button while the request is active and restores them afterward.