diff-logs does not report TLS failures after an ALLOWED connection #12

Summary

When OpenShell allows a connection and the client then fails the TLS handshake, diff-logs reports nothing.

Steps to reproduce

1. Run anthropic-proxy-rs (Rust, reqwest with rustls-tls, default features off, so it bundles webpki-roots) in a sandbox.
2. The deny log contains NET:OPEN ALLOWED ... followed by NET:FAIL [LOW] <synthetic ip>:443.
3. openshell-annotate diff-logs sandbox-logs.txt

Expected

A TLS_FAILURE finding with the hint: the client does not trust the OpenShell CA (rustls/webpki-roots, pinned certs, Java truststore); use tls=skip on the egress directive (loses L7 rules) or add the OpenShell CA to the client's trust store.

Actual

0 suggestions, while the app could not connect at all.

Found while testing five real projects (see the local candidate report). Numbered #6 in that report.