fix(client): apply TLS renegotiation without certificate

[jackwalkerlabs]

Summary

• apply client TLS options whenever a TLS block is present, rather than only when it contains a client certificate pair
• allow renegotiation-only TLS configuration while preserving optional mTLS certificates
• reject half-configured certificate pairs during normal configuration validation instead of silently ignoring them

Fixes #1736.

Root cause

HasTLSConfig only returned true when both certificate paths were present. That gate was shared by HTTP, WebSocket, and gRPC, so configureTLS never saw a certificate-free renegotiation setting.

Regression coverage

The new HTTP transport regression uses renegotiation: freely without certificate paths. On unchanged master it failed with RenegotiateNever; with this change it receives RenegotiateFreelyAsClient. Because the gate and configurator are shared, the same configuration path is used by HTTP, WebSocket, and gRPC.

Validation

• go test ./client -count=1
• make test
• go test ./... -race
• go build
• go vet ./...
• git diff --check

Agent disclosure

This pull request was made by the OpenAI Codex agent (GPT-5). All reported reproduction and validation commands were run against the submitted code.