Port Bun.connect TLS X509 socket matrix

Track the focused Bun TLS socket certificate slice from #66.

Upstream byte-identical corpus file:

• js/bun/http/bun-connect-x509.test.ts (81 lines, 2 tests)

Scope:

• activate the exact matrix instead of rewriting it to a native TODO
• expose getX509Certificate() and getPeerX509Certificate() on Home Bun sockets
• preserve the socket/listener hostname needed by X509Certificate.checkHost()
• keep certificate wrappers stable and GC-safe across repeated access
• cover both outbound TLS (example.com:443) and paired TLS listener/client sockets (localhost)

Acceptance:

• exact matrix: 2 pass, 0 fail, 0 unsupported, 0 todo
• copied corpus remains byte-identical to ~/Code/bun
• full Home gate passes
• commit/push directly to main as Chris Breuer with no coauthors
• close this issue with evidence and link it from #66.

Completed and pushed directly to main in dd8da42 (fix(runtime): port Bun socket X509 matrix).

Implemented cached getX509Certificate() / getPeerX509Certificate() wrappers for TLS sockets, preserved local/peer hostnames across outbound and paired listener connections, extended X509Certificate.checkHost() for socket certificate identities, propagated certificate metadata through TLS upgrades, and kept non-TLS sockets from exposing certificates. Repeated access returns stable cached wrappers for the upstream GC stress loop.

Verification on final source:

• exact byte-identical js/bun/http/bun-connect-x509.test.ts: 2 pass, 0 fail, 0 unsupported, 0 todo
• ./pantry/.bin/zig build test -Dfilter=home_test --summary failures: exit 0
• durable Home regression test runs the exact upstream matrix and asserts the 2/0/0/0 counts.