fix(infra): PR #115 round 4 — fix TLS detection + remove duplicate probe

Round 3 had:
1. rc captured from wrong command (tr always exits 0)
2. Every probe issued TWICE (26 invocations instead of 13)
3. TLS branch unreachable

Round 4 fixes:
- Restructure probe_http to ONE invocation that captures both output
  and status: out=$(...); rc=$?
- Delete the duplicated block
- Fix retry classification: don't overwrite kind if already set (e.g., tls)
- Add test 7b: TLS error (000 + exit 60) → kind is tls
- Update header output shape to include (<kind>) suffix

Test: 22 passed / 0 failed (bash scripts/test_infra_monitoring.sh)

scripts/infra-monitoring.sh

@@ -18,7 +18,7 @@
 #
 # Output shape per leg:
 #   ✅ <name>: alive
-#   🔴 <name>: probe-failed: <host>:<port> (expected <pattern>)
+#   🔴 <name>: probe-failed: <host>:<port> (expected <pattern>) (<kind>)
 #
 # Failure kinds: timeout | refused | tls | unexpected:<code> (printed in the failure line)
 
@@ -84,26 +84,16 @@ probe_http() {
     local code="" kind=""
     LAST_KIND=""
 
-    # First attempt
-    if [ -n "$ssh_host" ]; then
-        code=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "root@${ssh_host}" \
-            "curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 ${use_k:+-k} ${url}" 2>/dev/null)
-    else
-        code=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 ${use_k:+-k} "$url" 2>/dev/null)
-    fi
-
-    code=$(printf '%s' "$code" | tr -d '[:space:]')
-
-    # Capture curl exit code for TLS error detection
+    # Single invocation that captures both output and status
     if [ -n "$ssh_host" ]; then
         out=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "root@${ssh_host}" \
             "curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 ${use_k:+-k} ${url}" 2>/dev/null)
-        code=$(printf '%s' "$out" | tr -d '[:space:]')
+        rc=$?
     else
         out=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 ${use_k:+-k} "$url" 2>/dev/null)
-        code=$(printf '%s' "$out" | tr -d '[:space:]')
+        rc=$?
     fi
-    rc=$?
+    code=$(printf '%s' "$out" | tr -d '[:space:]')
 
     # Classify failure kind and retry if needed
     if [ -z "$code" ] || [ "$code" = "000" ]; then
@@ -112,18 +102,19 @@ probe_http() {
             35|51|58|59|60|77|83) kind="tls" ;;
             *) kind="timeout" ;;
         esac
+        # Retry once at longer timeout (25s connect, 30s max)
         if [ -n "$ssh_host" ]; then
-            # FIX C2: SSH retry at longer timeout (25s connect, 30s max)
             code=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "root@${ssh_host}" \
                 "curl -s -o /dev/null -w '%{http_code}' --connect-timeout 25 --max-time 30 ${use_k:+-k} ${url}" 2>/dev/null)
+            rc=$?
             code=$(printf '%s' "$code" | tr -d '[:space:]')
         else
-            # Retry once with longer timeout to distinguish
             code=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 25 --max-time 30 ${use_k:+-k} "$url" 2>/dev/null)
+            rc=$?
             code=$(printf '%s' "$code" | tr -d '[:space:]')
-            # Classify: timeout if still 000, refused if we get an unexpected response
+            # On retry, classify: still 000 = keep existing kind (or timeout if empty), unexpected status = refused
             if [ -z "$code" ] || [ "$code" = "000" ]; then
-                kind="timeout"
+                [ -z "$kind" ] && kind="timeout"
             elif ! echo "$code" | grep -qE "^(${expected})$"; then
                 kind="refused"
             fi