fix: distinguish clean TLS close from truncated EOF

[kentbull]

What

• Disable ragged-EOF suppression for ClientTls and RemoterTls.
• Keep TLS WANT conditions retryable.
• Distinguish authenticated close_notify, abrupt EOF, and fatal TLS/socket failures.
• Make server removal safe after receive has already force-closed the TLS socket.

Why

Returning empty bytes for both authenticated closure and abrupt TCP EOF erases whether the protected stream ended cleanly or was truncated.

Background

Python normally suppresses ragged TLS EOF and returns empty bytes. Passing suppress_ragged_eofs=False exposes missing close_notify as an exception. This PR classifies the receive outcome; PR #15 later applies the negotiated TLS 1.2 or TLS 1.3 peer-close policy.

Boundary

TLS send classification, recurrent local shutdown through unwrap(), and negotiated-version peer-close policy remain separate changes.

[kentbull]

Upstream prerequisites: accepted independent receive/transmit terminal state and retained terminal causes for both Client and Remoter—the behavioral foundations from #9 and #10. ioflo#163 currently supplies only part of the Remoter side.

Once that contract is merged, TLS receive handling can distinguish retryable WANT conditions, clean close_notify, ragged EOF, and fatal transport failure. Graceful TLS shutdown is not a prerequisite for this classification.

[kentbull]

Implements downstream receive classification for ioflo#173 by disabling ragged-EOF suppression and separating retryable WANT conditions, authenticated close_notify, abrupt EOF, and fatal TLS/socket failures for ClientTls and RemoterTls. #15 supplies negotiated-version peer-close policy, and #16 expands regression coverage.