bug(network): relay setup refused when an unrelated reload lands during setup #5367

Summary

A new proxied connection is refused if any policy generation change lands between its authorization and the start of its relay, even when the change doesn't affect it. Under a burst of reloads or provider refreshes, unrelated connection attempts fail intermittently.

Cause

Relay setup pins the generation that authorized the connection and refuses to start if it has moved (OpaEngine::generation_guard: "policy changed before HTTP relay started"). The upstream dial is also abandoned on any generation change (proxy.rs, the dial select! on wait_until_stale).

Steps to reproduce

1. Run a client that opens many short connections through the proxy to host A.
2. Meanwhile, trigger frequent unrelated generation changes, for example by approving endpoints for host B or refreshing a provider.
3. Some connections to A are refused with "policy changed before HTTP relay started".

Expected

Setup re-checks the connection against the new generation and continues if its policy outcome is unchanged, as established connections should.

Environment

OpenShell main at af8182f.

Drafted with Claude Code.