fix: enforce negotiated TLS peer-close policy

[kentbull]

What

• Apply authenticated peer-close policy using SSLSocket.version().
• Keep accepted output sendable after TLS 1.3 close_notify.
• Start reciprocal shutdown after TLS 1.2 close_notify and report the exact stranded-byte count.
• Fail closed when the negotiated version is missing or unsupported.
• Drain plaintext buffered by TLS before local unwrap().

Why

TLS 1.2 requires reciprocal closure and discarded pending writes. TLS 1.3 ends only the peer's write direction, leaving local transmission available. Applying one policy to both versions either loses valid output or permits forbidden transmission.

Background

SSLSocket.unwrap() drives OpenSSL shutdown recurrently through WANT states. This PR adds the policy for the version actually negotiated on the connection and keeps accepted-output loss observable.

Boundary

PR #16 fixes a later unwrap() retry race and expands shutdown coverage. HTTP framing, owner deadlines, close invocation, package metadata, and publication remain separate concerns.

[kentbull]

Upstream prerequisite: the recurrent unwrap() shutdown state machine from #14, including truthful close_notify detection and the accepted unsent-output/error contract from #9–#12.

Once that exists, upstream can add negotiated TLS 1.2 versus TLS 1.3 peer-close policy, exact stranded-output reporting, and fail-closed handling for unknown negotiated versions.

[kentbull]

Implements the primary downstream fix for ioflo#177: negotiated TLS 1.2 versus TLS 1.3 peer-close policy, exact stranded-output reporting, and fail-closed handling for missing or unsupported negotiated versions.