fix(javascript): omit TLS sockets whose secureProtocol Node rejects - #10530

Summary

JavaScript static analysis reported a socket acquisition for tls.connect calls that Node rejects because of secureProtocol. These calls no longer produce a resourceOperations acquisition, the same as a rejected minVersion.

Fixes #10524

Problem and expected behavior

Measured in Node 24.22.1 with tls.connect({ port: 9, host: "127.0.0.1", ... }):

Change and scope

• rejectsTlsProtocolVersionLiteral now ends with rejectsSecureProtocolLiteral, which reads secureProtocol through the same effective reader. That reader already handles merged option objects, accessors, __proto__ and the truthy-secureContext bypass.
• The accepted names are a closed, case-sensitive set, like TLS_PROTOCOL_VERSIONS.
• The conflict rule needs a proven truthy secureProtocol and a version member proven to be neither null nor undefined. Unknown values stay.

Contribution scope: ordinary fix within existing boundaries; maintainer scope decision not applicable.

Contract and boundary impact

• Semantic owner and earliest changed stage: rejectsTlsProtocolVersionLiteral in javascriptSemanticResources.ts.

• Contribution scope fit and linked maintainer decision: not applicable.

• CLI and MCP/tool-catalog contract: none.

• Provider, bridge, target-format, or platform compatibility: none.

• Evidence, artifact, provenance, or reconstruction contract: fewer false socket facts; undecided calls are unchanged.

• Target selection, authority, upstream behavior, and cleanup details: not applicable.

• Generated metadata, package, or installation impact: none.

• Read existing files or captured data.

Evidence and regression coverage

• Tests added: src/domain/javascript/javascriptSemanticAnalysis.tls_secure_protocol_literal.test.ts, one row per rejected and accepted form above.
• Base reproduction: the new file on main source: 13 failed / 14 passed. With this change: 27 passed.
• The existing tls_protocol_version_literal tests still pass (128 passed for both files).

Validation performed

Windows 11 Home 10.0.26200 x64, Node 24.22.1, base 9e24b36.

• npx vitest run src/domain/javascript/javascriptSemanticAnalysis.tls_secure_protocol_literal.test.ts on main source: 13 failed / 14 passed; with this change: 27 passed.
• npx vitest run src/domain/javascript src/application/javascript: 217 files, 6409 passed / 7 skipped.
• Review follow-up (d131e32): an exactly read method name, including a no-substitution template, decides its own truthiness, so secureProtocol: `TLS_method` beside a version member reaches the conflict check.
• Merged main fe80d52 in c6ad59c. Main's 91297ca moved the option reading into the shared socketOptionReader; the only conflict was a doc comment, and rejectsSecureProtocolLiteral reads through the same reader. After the merge: the new file on main source 13 failed / 14 passed, with this change 27 passed; src/domain/javascript src/application/javascript 218 files, 6502 passed / 7 skipped.
• Review follow-up (0beb435): the shared staticJavaScriptTruthiness reader now decides a regular-expression literal and a class expression as truthy, so secureProtocol: /x/ or class {} beside a version member reaches the conflict check. The new file now has 29 rows, all passing; src/domain and src/application show no new failures.
• npm run check:fast: passed (typecheck, lint)
• git merge-tree against the open PRs that edit javascriptSemanticResources.ts: clean with every one that merges cleanly with main (fix(javascript): judge an options-object socket port like a positional one #9693, fix(javascript): resolve FileHandle releases after reassignment #10258, fix(js): degrade release resolution when the released method is replaced on the receiver #10473).

Compatibility, safety, and release

• Breaking changes or migration steps: none.
• Real Hopper/Ghidra, browser, or OS coverage: Node 24.22.1 on Windows 11. The method-name list comes from Node's bundled OpenSSL; Linux was not measured.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: analysis only; the measurements targeted 127.0.0.1:9.

Author readiness

Human owner: @Plastic-time

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.