fix(tui): recover poisoned TLS client generations

[yxlyx]

Closes #691.

What changed

• Added a launch-level recovery manager for model HTTP traffic. Both non-streaming http.postWatched calls and streaming Agent.postStreamWithClient calls lease the active client generation.
• When std.http.Client.request returns TlsInitializationFailed before a Request exists, retire that generation and publish a CA-prewarmed replacement. Concurrent callers keep the retired generation alive until their final lease releases; stale reports do not rotate twice.
• Added a lifecycle gate around global recovery lookup/publication and teardown. Shutdown closes admission, drains active/retired leases and CA-ready waiters, then destroys owned clients; calls targeting the retired launch client are rejected while unrelated std.http.Client instances remain usable.
• Centralized the launch CA-ready barrier at the two request constructors, including direct postWatched users such as server compaction, and added distinct breadcrumbs for launch CA failure, replacement CA failure, TLS rotation, and final retry exhaustion.
• Corrected retry accounting so a six-attempt plan performs six attempts rather than seven, keeps one total-attempt budget when error classes change, and preserves 429/5xx attribution at exhaustion.
• Added deterministic regressions for real malformed TLS handshakes through both production catches, repeated and simultaneous stale-generation failures, replacement allocation/CA failures, shutdown races, lease reclamation, retry exhaustion followed by successful later root/child calls, TUI root-agent construction, foreground runSub, and background execSubagent/agentOutput.

Why

A transient network transition can poison the launch-owned std.http.Client at request construction, before the existing post-construction connection cleanup has a Request to mark closing. Retrying the same client therefore leaves every later model-backed TUI trajectory failing until the process is replaced.

Generation leasing fixes that lifecycle boundary rather than masking individual failures. One poisoned client can be retired immediately while in-flight compaction, root, or child calls safely finish on the object they already leased, and later retries resolve the original launch pointer to the replacement.

The design intentionally applies to model request constructors rather than every best-effort launch HTTP consumer. The original launch client is never deinitialized by rotation because telemetry/fleet callers may still hold its pointer. The cost is one mutex-protected lookup per model request plus temporary retention of retired generations while calls remain in flight.

Reinitializing the shared client in place was rejected because concurrent users can still dereference it. Creating a fresh client for every request was rejected because it discards connection pooling and repeatedly reloads CA state. Relying on debug assertions or external job-join ordering was rejected because ReleaseFast teardown still needs an in-process lifetime guarantee.

Verification

• Three independent five-agent adversarial review rounds covered streaming roots/synthetic wakes, foreground/background children and workflows, compaction/server-compaction, title/recap and CA observability, retry accounting, plus concurrency/memory/shutdown edges.
• scripts/eval-tier1.sh — green with the test-count ratchet updated to the verified suite size.
• Unit suite: 1,783 passed, 1 skipped.
• Focused TLS suite: 54/54 passed.
• Fullscreen TUI suite: 459/459 passed.
• Real-binary TUI guards: 17/17 passed.
• zig build -Doptimize=ReleaseFast — green.
• git diff --check — clean.

[justrach]

Folded into release/v0.0.282 (#696), including the TLS-lifecycle follow-up. Closing as superseded. ADR is 0048.