* ssl: accept ClientHello before selecting the SNI context
Replace the provisional server connection and replay flags with explicit handshake states. Retain fatal alerts across nonblocking retries and preserve fragmented input on timeout. Enable the three SNI alert regressions.
Assisted-by: Codex:GPT-5
* ssl: share socket and MemoryBIO transport progress
Queue drained TLS records before fallible output and use one handshake record loop for both transports.
Assisted-by: Codex:GPT-5
* ssl: unify shutdown and fatal alert lifecycle
Track close-notify progress in TlsState, preserve pending alerts across retries, and share record-boundary shutdown for sockets and MemoryBIO. Retain rustls errors until Python exception conversion.
Assisted-by: Codex:GPT-5
* ssl: emit the full peer certificate dict
Use the same certificate dict helper for getpeercert() and
Certificate.get_info() so OCSP, caIssuers, and CRL URLs are present.
Clear CHANNEL_BINDING_TYPES on the rustls backend, and add a MemoryBIO
leftover-plaintext snippet.
Assisted-by: Claude
