Port SQL TLS negotiation and protocol-confusion contracts

Context

The sequential Bun corpus frontier has advanced through js/sql/sqlite-url-parsing.test.ts and now reaches js/sql/tls-sql.test.ts at position 3946/4708. This follows #206 and remains part of #205 / #66.

First observed gap

The PostgreSQL client sends the generic Home startup marker where the mock server expects the exact 8-byte SSLRequest frame (00 00 00 08 04 d2 16 2f). This prevents the protocol-confusion tests from verifying that TLS negotiation rejects PostgreSQL/MySQL messages received in place of the one-byte SSL answer.

Acceptance criteria

• PostgreSQL TLS startup emits the exact SSLRequest frame before startup/authentication traffic.
• PostgreSQL protocol frames received as the SSL response are rejected deterministically.
• MySQL TLS negotiation rejects plaintext/protocol packets after the TLS capability exchange.
• Errors retain stable SQL error identity and do not leak native stack/transport internals.
• js/sql/tls-sql.test.ts passes completely and is pinned in the permanent SQL contract gate.
• Existing SQLite and SQL adapter gates remain green.

Completed on main in b10d315dc548c64c2119770f9908615b47f63c57 (fix(sql): enforce PostgreSQL TLS negotiation), with the shared wire-frame guard pinned in 0f1d9eb9a189137276fde94bed00c96f218a99a2.

Results:

• js/sql/tls-sql.test.ts: 2 passed, 1 expected Docker TODO, 0 failed, 0 unsupported.
• PostgreSQL sends the exact 8-byte SSLRequest before any startup/authentication traffic.
• Any response other than one-byte S/N is rejected as ERR_POSTGRES_UNEXPECTED_MESSAGE without writing credentials to plaintext.
• Explicit TLS refusal (N) is rejected as ERR_POSTGRES_TLS_NOT_AVAILABLE without plaintext downgrade.
• js/sql/wire-frames.test.ts: 5/5 passed and permanently pinned.
• The full permanent SQL adapter gate remains green.

The sequential frontier advances through 3947/4708. The next non-SQL frontier is tracked in #208.