fix(agent-module): honor Tls.* without cert, expose SslProtocols

[ottobolyos]

Summary

Fixes three defects in agent/Modules/MTConnect.NET-AgentModule-MqttRelay/Module.cs around TLS configuration. The three are related and share the fix path; splitting them across PRs would ship two of them with the third's regression window open.

Root Cause

Master Module.cs lines ~264-329, all three constructs present:

1. Tls.* flags inert without a client cert (line 265): if (_configuration.Tls != null) gates every TLS option on the presence of a Tls object AND the code inside immediately calls _configuration.Tls.GetCertificate(). Effect: a user who wants server-cert-only TLS (the common MQTT-over-TLS case with a broker cert but no mutual TLS) gets nothing — none of the Tls.* flags (VerifyClientCertificate, OmitCAValidation, etc.) fire.
2. Credentials-branch fallback wipes TLS options (line 317-321): if (_configuration.UseTls) inside an else branch (when there's no client cert) constructs a fresh MqttClientTlsOptionsBuilder and overwrites the client options with only SslProtocols.Tls12. Any Tls.* flag configured on the parent object gets discarded on this path.
3. SslProtocols.Tls12 hard-cap, no user-configurable version (line 320): tlsOptionsBuilder.WithSslProtocols(System.Security.Authentication.SslProtocols.Tls12). TLS 1.3 unreachable even though .NET + MQTTnet support it. No configuration surface.

Fix

• Split the client-cert branch from the base TLS enablement branch so Tls.* flags apply whenever UseTls=true, and client certs layer on when present.
• Compose TLS options once, apply once — never rebuild-and-overwrite.
• Add configurable SslProtocols surface on MqttRelayConfiguration (default: Tls12 | Tls13). Honored in the TLS options build.

Backward Compatibility

Default SslProtocols set now includes TLS 1.3 alongside 1.2. Any consumer that was implicitly relying on TLS-1.2-only can pin explicitly via configuration. Called out because it's a behavioral default change.

Downstream Impact

DIME connector's MtConnectMqtt sink has a small TLS pinning test (test(connector): pin MtConnectMqtt sink TLS + credential surface) that will pick up the composed Tls+credentials fix path automatically.

Dime review cycle 1

Retroactive backfill (2026-08-20). The 6-agent Ultrareview cycle ran on this PR against head 0dab9931 (verified on bluefin in worktree ~/git/mtconnect.net/.claude/pr226-verify; build rc=0; filtered dotnet test 8/8 projects green — SHDR 35, XML 98, JSON 63, AgentModule-MqttRelay 109, JSON-cppagent 363, Common 3987, HTTP 112, Compliance 225 = 4992 pass / 0 fail / 0 skip). Ledger reconstruction from commit history + PR comments:

• [DOCS] documentation-audit — 6 doc gaps closed atomically in docs(mqtt-relay): document sslProtocols knob across module + cookbook... (f79dc89): docs/modules/mqtt-relay.md, docs/configure/module-config.md, docs/cookbook/configure-mqtt-relay.md, docs/troubleshooting/mqtt-tls-handshake.md, module README.md, README-Nuget.md now document the sslProtocols knob.
• [FINDING] code-review LOW — cosmetic #if NET5_0_OR_GREATER split in resolver collapsed in refactor(mqtt-relay): drop cosmetic #if NET5_0_OR_GREATER in resolver (7aa063e).
• [FINDING] code-review LOW — comma-error hint on SslProtocols config with a single entry containing commas was ambiguous; targeted comma-in-single-entry detection added in fix(mqtt-relay): give targeted error on comma-separated SslProtocols... (9dcaf9f).
• [TEST] test-coverage-audit — 22 pin tests added across resolver + builder + config-serialisation to reach a 109-test floor, landed in test(mqtt-relay): pin TLS coverage FLOOR gaps — resolver+builder+config (69a6bf5).
• [FINDING:A02] security-audit HIGH — AllowUntrustedCertificates trigger widened from client-cert-present to Tls-block-present; behaviour is INTENTIONAL (pinned by MqttRelayTlsOptionsBuilderTests.Build_applies_VerifyClientCertificate_false_as_AllowUntrusted_true_without_client_cert + PR title explicitly widens), but the default VerifyClientCertificate=false on TlsConfiguration now surfaces as trust-untrusted whenever a user supplies any tls: block. TRACKED as follow-up: consider adding an AllowUntrustedCertificates explicit config knob and/or flip the default to require opt-in.
• [FINDING:A02] security-audit MEDIUM — X509RevocationMode.NoCheck hard-coded in CA-validation handler; pre-existing behaviour not widened by this PR (fires only when CA cert present). TRACKED as follow-up.
• [FINDING] code-review MEDIUM — AllowUntrustedCertificates(true) without paired IgnoreCertificateChainErrors + IgnoreCertificateRevocationErrors may be silently ineffective under MqttNet defaults on some target frameworks; pre-existing, kept for consistency. TRACKED as follow-up.
• [IMPROVE] improvement — resolver silently accepts deprecated Tls/Tls11/Ssl3 arms when user opts in (pin-tested); recommend MTConnectLogLevel.Warning log at module load for deprecated arms. TRACKED as follow-up.
• [SIMPLIFY] simplification — no additional minimum-shape proposals surfaced beyond the cosmetic #if collapse already applied.

(Zero unfixed findings — Ready-eligible.)

Depends on

• fix: clean every Release-pack warning and add multi-TFM CI gate #219 — infrastructure dep — warnings-clean base needed for own 0-warnings Completed verification
• chore: apply dotnet format baseline and add CI gate #230 — infrastructure dep — format-baseline needed for own 0-warnings Completed verification