feat(acp): retry initial relay connection with terminal/transient error classification

[wpfleger96]

Summary

ACP agent startup previously made exactly one relay connection attempt — any dropped WebSocket handshake on a spotty link failed the agent outright, requiring a manual respawn.

retry_initial_connect() retries transient failures with jittered backoff (1 immediate + 5 delayed attempts at 1/2/4/8/16s base intervals), sharing the delay schedule already used by the post-start reconnect loop via STARTUP_CONNECT_BACKOFFS. Terminal errors fail immediately since retrying them is pointless.

Classification contract

is_terminal_connect_error() classifies every RelayError variant, and is_terminal_ws_error() exhaustively classifies every tungstenite::Error inner variant (no wildcard — a tungstenite upgrade forces reclassification at compile time).

Terminal (fail fast):

• RelayError::Http — HTTP-level rejection
• RelayError::Json / RelayError::UnexpectedMessage — protocol mismatch
• WebSocket(Url(_)) — deterministic URL/scheme misconfiguration (never reaches the network)
• WebSocket(Capacity(_)) / WebSocket(Utf8(_)) / WebSocket(HttpFormat(_)) / WebSocket(AttackAttempt) — deterministic handshake-shape failures
• WebSocket(Http(resp)) — non-101 HTTP response, unless status is 408, 429, or 5xx (server-side transient conditions that can recover)
• WebSocket(Protocol(_)) — all variants (wrong method/version, missing/invalid upgrade headers, accept-key mismatch, junk-after-request, etc.) except HandshakeIncomplete and ResetWithoutClosingHandshake (connection dropped mid-handshake or abrupt reset — link-level failures)
• WebSocket(Tls(_)) — deterministic TLS config failures. On our rustls build the only connect-time Tls variant is InvalidDnsName
• WebSocket(Io(_)) with a deterministic rustls::Error in the source chain — tokio-rustls wraps rustls handshake failures as io::Error with the rustls::Error as source; tokio-tungstenite surfaces these as Error::Io. Classifier walks get_ref() + source() chain to find the rustls::Error, then matches a terminal allowlist: InvalidCertificate(_), InvalidCertRevocationList(_), NoCertificatesPresented, UnsupportedNameType, PeerIncompatible(_) — deterministic cert/config/incompatibility failures that retry cannot fix. Relies on a single rustls version in the dep tree (0.23.40)
• AuthFailed with invalid: / auth-required: / restricted: / blocked: prefix, or any unrecognized prefix (fail-safe)

Transient (retry):

• WebSocket(Io(_)) without a rustls source, or with an ambiguous rustls error (AlertReceived(_), InappropriateMessage/InappropriateHandshakeMessage, InvalidMessage(_), DecryptError, PeerMisbehaved(_), General(_), and any other non-allowlisted variant — rustls::Error is #[non_exhaustive], so unknowns default transient) — plain transport failures (reset, EOF, timeout, refused, mid-handshake TLS transport loss) and ambiguous protocol/decrypt/server-alert shapes stay retryable under the bounded budget
• WebSocket(ConnectionClosed) — link-level closure
• WebSocket(AlreadyClosed) / WebSocket(WriteBufferFull(_)) — unreachable during connect_async; kept fail-safe transient
• WebSocket(Http(resp)) where status is 408, 429, or 5xx
• WebSocket(Protocol::HandshakeIncomplete) / WebSocket(Protocol::ResetWithoutClosingHandshake)
• RelayError::ConnectionClosed / Timeout / NoAuthChallenge
• AuthFailed with error: prefix — relay dependency fault (e.g., ban-state DB lookup failure), distinct from an explicit credential rejection

Changes

• Add retry_initial_connect() with the jittered backoff schedule
• Add is_terminal_connect_error() that classifies every RelayError variant
• Add is_terminal_ws_error() with exhaustive match on every tungstenite::Error variant including Http status split and per-Protocol-variant classification
• Add is_terminal_rustls_io_error() — walks io::Error inner error + source chain to find a rustls::Error wrapped as Io by tokio-rustls/tokio-tungstenite, then matches a deterministic cert/config/incompatibility allowlist (InvalidCertificate, InvalidCertRevocationList, NoCertificatesPresented, UnsupportedNameType, PeerIncompatible); ambiguous protocol/decrypt/server-alert shapes (AlertReceived, DecryptError, InappropriateMessage, General, etc.) default transient under the bounded retry budget
• Add is_terminal_auth_failure() that classifies AUTH rejection text by NIP-01 prefix, cross-referenced against crates/buzz-relay/src/handlers/auth.rs
• Extract STARTUP_CONNECT_BACKOFFS shared between startup and reconnect loops
• Table-driven test covering every RelayError variant and every tungstenite::Error inner variant, including production-shaped Io-wrapped rustls errors terminal on the allowlist (InvalidCertificate(Expired), InvalidCertificate(NotValidForName), NoCertificatesPresented), transient on ambiguous variants (General, AlertReceived(InternalError), DecryptError), explicit transport-transient rows (ConnectionReset, UnexpectedEof, TimedOut), and Tls arm-pinning rows (InvalidDnsName, CertificateError::Expired)
• Async do_connect_wrong_scheme_is_terminal test driving a literal https:// URL through production do_connect()
• Tests for error:-prefixed AuthFailed retry/recovery, terminal error fail-fast, exhaustion, and backoff sleep behavior

[wesbillman]

One classification issue remains: deterministic TLS certificate/configuration failures are retried as transient. I left an inline comment requesting a split and regression coverage.

The retry loop and remaining exhaustive WebSocket classification otherwise look solid, and current CI is green. The branch is 22 commits behind main; rebase and rerun CI after the code fix before approval.