Readable.toWeb(): uncaughtException (ERR_INVALID_STATE "Controller is already closed") when the stream is canceled during backpressure resume

### Version v22.23.1 (also affects `main` — the unguarded code is still present) ### Platform ```text Linux (Docker, x86_64) — also reproduced on Darwin 25.5.0 arm64 ``` ### Subsystem stream, webstreams ### What steps will reproduce the bug? Convert a Node `Readable` (e.g. a `PassThrough`) to a web `ReadableStream` with `Readable.toWeb()`, pipe it to a slow sink so backpressure pause/resume cycles occur, and cancel/abort mid-transfer (as happens whenever an HTTP client disconnects while a server streams a response built from `new Response(Readable.toWeb(nodeStream))`): ```js // repro.mjs — node repro.mjs import { PassThrough, Readable, pipeline as pump } from "node:stream"; let uncaught = 0; process.on("uncaughtExceptionMonitor", (e) => { if (++uncaught === 1) console.log(e.stack); }); process.on("uncaughtException", () => {}); async function one() { const src = new Readable({ read() { this.push(Buffer.alloc(16 * 1024, 1)); if ((this.bytes = (this.bytes || 0) + 16384) > 512 * 1024) this.push(null); }, }); const pt = new PassThrough({ highWaterMark: 16384 }); pump(src, pt, () => {}); const web = Readable.toWeb(pt); const ac = new AbortController(); const writer = new WritableStream( { async write() { await new Promise((r) => setTimeout(r, 1)); } }, // slow sink → backpressure { highWaterMark: 1 }, ); setTimeout(() => ac.abort(), Math.floor(Math.random() * 12)); // client disconnect try { await web.pipeTo(writer, { signal: ac.signal }); } catch {} await new Promise((r) => setImmediate(r)); } for (let i = 0; i < 400; i++) await one(); console.log(`uncaught=${uncaught}/400 node=${process.version}`); ``` ### How often does it reproduce? Is there a required condition? 400/400 iterations on v22.23.1 with the harness above. Required conditions: the source is flowing under backpressure (pause → `pull()` → `resume()` cycles) and the web stream is canceled (directly or via `pipeTo` abort) while a resume tick is alread…