Fix file descriptor leak in pipe-bootstrap on error paths

[vigneshakaviki]

Summary

Fixes a file descriptor leak in the pipe-bootstrap command where file descriptors were not closed on error paths.

Fixes #23256

Problem

The Run() function in command/connect/envoy/pipe-bootstrap/connect_envoy_pipe-bootstrap.go opened a file descriptor via os.OpenFile() but failed to close it when either:

1. The os.OpenFile() call returned an error (line 62)
2. The buf.WriteTo(f) call returned an error (line 67)

This caused file descriptor leaks under error conditions, which can lead to resource exhaustion and process instability.

Solution

Added defer f.Close() immediately after successful file opening, ensuring the descriptor is closed in all code paths including error cases.

Changes

• Added single line: defer f.Close() after successful os.OpenFile() call
• Minimal, focused change with no behavioral modifications
• Idiomatic Go error handling pattern

Testing

• Existing tests cover the error paths and will verify the fix
• No new tests required (defer behavior is standard Go semantics)

Impact

Risk: Minimal - single line addition with no logic changes
Benefit: Prevents file descriptor exhaustion during bootstrap failures
Scope: Internal Envoy bootstrap mechanism only

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Test User seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Test User seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}