fix: do not re-attempt https after the scheme fallback

[knakul853]

Change

The HTTP 400 upgrade added in #2577 did not check whether https had already been attempted. When the scheme heuristic probes https first (bare host, or a port <=1024 other than 80/8080), that attempt fails, the pre-existing error fallback switches to http, and the plaintext service answers 400, the upgrade retried the same https endpoint a second time.

• Guard the upgrade on !retried, so the fallback's already-failed https attempt is not repeated.
• Test asserts exactly one CONNECT reaches the endpoint, and that the result stays http/400.

Trade-off taken deliberately: !retried also suppresses https-on-port-80 after an https :443 failure rewrites the target to :80. Judged not worth the extra state to preserve; happy to revisit.

Evidence

Test fails without the guard (2 attempts, "the same https endpoint must not be attempted twice"), passes with it - patch removal asserted, so the control is real.
All 5 upgrade/retention tests pass under -race; full runner suite green; integration 21/21 across 3 runs on this branch and on dev.
Cost measured: 0.90s vs 2.81s locally, up to a full -timeout (10.11s at -timeout 10) against a host that accepts the TLS connection and never replies.

Still open

• Does not close Reduce latency from unsuccessful HTTPS upgrade after plaintext HTTP 400 #2580 - an http-first plaintext 400 still costs one unbounded https attempt; that needs a bounded deadline and is a separate change.

---

Claude-Session: https://claude.ai/code/session_015AKXsNzjd3HjGMq4B8JCNH
Claude-Local-Session: claude --resume 0fe5b680-5ba5-43e6-b354-43d4388aaf9c

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}