test(hosts): cover the renewal loop and the expiry watchdog #84

connection.Run (apps/host_agent/internal/connection/client.go, Run) has no Go unit test for its renewal branches, including the fix that keeps a valid identity connected when renewal fails (pilot commit "fix(hosts): keep a valid identity connected when renewal fails"). TestExpiryWatchdogCancelsBlockedIO (client_test.go:148) only tests watchValidity with a stub callback: no WebSocket, no blocked read, and not the cancel() + ws.CloseNow() wiring in session.

Acceptance criteria

• Tests drive Run against a loopback TLS server for: renewal succeeds; renewal fails while the active certificate is valid (session still runs); reload fails after renewal (returns ErrTransport, no panic).
• A test blocks a real loopback ws.Read and proves session ends it at the validity deadline.
• TestExpiryWatchdogCancelsBlockedIO is renamed or replaced so its name matches what it proves.
• New test IDs are added to docs/development/ci-acceptance.json; make check is green.

Found by the independent pilot review on 2026-10-16. Builds on the pilot branch pilot/installable-pilot-pr (split from #83); start from its current head.

🤖 Generated with Claude Code