Port Valkey TLS verification corpus

Bun compatibility slice

Port js/valkey/valkey-tls-verify.test.ts at exhaustive corpus position 4082.

Required behavior

• reject CA-trusted certificates whose DNS/IP names do not match with ERR_TLS_CERT_ALTNAME_INVALID;
• preserve the distinct DEPTH_ZERO_SELF_SIGNED_CERT chain error;
• allow mismatches when verification is disabled;
• accept matching localhost/IPv6 SANs and CA-trusted Unix-socket TLS connections;
• retain TLS operation, endpoint, TLS code, and causal stack metadata while redacting credentials and paths;
• cover the complete seven-test platform surface in focused and permanent gates.

Tracked from #66.

Implemented and pushed in 6d7f90b04.

All seven Valkey TLS verification cases pass. DNS and IP identity mismatches surface ERR_TLS_CERT_ALTNAME_INVALID; an untrusted chain retains DEPTH_ZERO_SELF_SIGNED_CERT; verification-disabled, matching localhost/IPv6 SAN, and CA-trusted Unix-socket cases return PONG.

ValkeyTLSError retains valkey.tls, endpoint, tlsCode, and the original verification cause in its stack while redacting credentials, database paths, and query secrets.

Verification:

• focused position 4082: 7 passed, 0 failed, 0 todo, 0 unsupported;
• adjacent positions 4081–4082: 8 passed, 0 failed, 0 unsupported;
• permanent mini-suite: passed, including 49 structured-error diagnostics;
• formatting and diff checks: passed.