Tighten mTLS port probe to suppress false Envoy warnings on TLS-only ports

[saiakhil2012]

Overview

The pre-flight port probe introduced in #195 produced a spurious warning when Envoy was healthy. This corrects the probe logic to accurately distinguish between a non-TLS service claiming the port and expected TLS rejection.

Root Cause

curl -w '%{http_code}' always writes the HTTP status code to stdout regardless of exit status. The trailing || echo '000' fallback was doubling the output to 000000, which failed the != "000" guard and triggered the warning even when Envoy was operating correctly in mTLS-only mode.

Change

• Removed the || echo '000' fallback — unnecessary given curl's -w behavior
• Replaced the string equality check (!= "000") with a regex (^[1-9][0-9]{2}$) that only warns on a real HTTP status code (100–999)
• Envoy in mTLS mode returns 000 (no HTTP response at TLS layer), which now correctly passes the probe silently
• A rogue HTTP service on the port still returns a real status code and triggers the warning as intended

Behavior

Scenario	Before	After
Envoy running (mTLS)	⚠ False warning	Silent ✓
Non-TLS service on port	⚠ Warning	⚠ Warning ✓
Port closed / nothing	Silent	Silent ✓