fix(infra): PR #115 final round — complete F1/C1 + implement TLS detection

F1: Set LAST_KIND on unexpected-status path (was unset, causing empty
     placeholder in 7 failure lines).
F2: Implement TLS detection — capture curl exit code and map TLS
     error codes (35|51|58|59|60|77|83) to kind=tls. Previously
     TLS failures were misdiagnosed as timeout.
F3: Header comment now lists all producible kinds:
     timeout | refused | tls | unexpected:<code>.
F4: Add 2 test assertions: Grafana failure line exists + kind
     is non-empty (proves the gap that shipped in round 2).

Test: 20 passed / 0 failed (bash scripts/test_infra_monitoring.sh)

scripts/test_infra_monitoring.sh

@@ -134,6 +134,37 @@ assert "Port 9325 (historical) NOT in script source" \
 assert "Port 9405 (historical) NOT in script source" \
     '! grep -q "9405" "$SCRIPT"'
 
+# ── 7. Failure-line content includes non-empty kind ────────────────────────
+# Stub curl to return 500 (unexpected status) and verify failure line has (<kind>)
+TMP_DIR=$(mktemp -d)
+cat > "$TMP_DIR/curl" << 'EOF'
+#!/bin/bash
+# Stub: return 500 for Grafana port, 200 otherwise
+for arg in "$@"; do
+    if [[ "$arg" == *":3001"* ]]; then
+        echo "500"
+        exit 0
+    fi
+done
+echo "200"
+exit 0
+EOF
+chmod +x "$TMP_DIR/curl"
+# Run script with stubbed curl and capture output
+OUT=$(PATH="$TMP_DIR:$PATH" bash "$SCRIPT" 2>&1)
+# Find the Grafana failure line and verify it has a non-empty kind
+GRAFANA_FAIL=$(echo "$OUT" | grep "Grafana: probe-failed")
+assert "Grafana failure line exists" \
+    '[[ -n "$GRAFANA_FAIL" ]]' 
+
+# Extract the kind from the failure line (should be <unexpected:500>)
+KIND=$(echo "$GRAFANA_FAIL" | grep -oP '\(<[^>]+>\)' | tr -d '()<>')
+assert "Grafana failure kind is non-empty" \
+    '[[ -n "$KIND" ]]' 
+
+# Cleanup
+rm -rf "$TMP_DIR"
+
 # ── Summary ─────────────────────────────────────────────────────────────────
 echo ""
 echo "Results: ${PASS} passed, ${FAIL} failed"