test(session-net): investigate extra connection in terminal watch conformance

[VerifiedOrganic]

The IPsec LB kernel-independent conformance job observed a second accepted TCP connection in client::tests::terminal_watch_sequence_is_delivered_once_without_reconnect. The client had already received the u64::MAX entry and its stream ended; the fixture's final connection-count assertion observed 2, expected 1.

Observed on PR #801 head e36cafaad5eaa04a5db9e424de17785bf926ebf4, tested merge 18549552663ead45b188ac112b0e9c198c380f64, tree 399a6e7fd9a6e1f9208a0d98fbbdda72cba93977. Original failing job, attempt 1.

The failing assertion is in crates/opc-session-net/src/client.rs:7018. The library summary was 590 passed, 1 failed, 2 ignored, with 9 filtered out. The complete original job log is preserved with SHA-256 1898820db1dbddec2fbfec7e18dae7c03bf4b59c57e7ca4d383cb52844ce3d0d.

This file is unchanged by #801. Source inspection shows the delivered terminal entry exits the watch loop before the reconnect branch, but the original trace does not identify who opened the extra connection. That inspection does not establish a cause or rule out a transport defect. A passing unchanged rerun must not be described as a fix.

The conformance test passed on workflow attempt 2, on the same tested merge and tree: attempt 2. Its original log SHA-256 is cd818f45858f9a7e52836882722dbcb6d67bc6ac09edeb25b8113d6d75b548f4. All four IPsec LB jobs have new attempt-2 records, but only conformance actually re-executed. The documentation, object-rebuild and privileged-datapath success records retain their original execution times, complete step metadata and runner identity. Their new job IDs do not represent new executions. The conformance execution ran from 18:37:17 to 19:03:35 UTC; the literal historical rerun request was not recorded. No source or test change accompanied this attempt. The original failed outcome remains preserved and its cause remains unknown.

Acceptance:

• Preserve the original failure and reproduce with connection-attempt ownership and ordering established before attributing the extra accept.
• Distinguish a watch-owned reconnect from another fixture connection using bounded synthetic evidence.
• Keep final-entry delivery, no sequence wrap, single delivery, stream closure, and the original deadlines enforced.
• If a defect is identified, preserve a failing detector and a causal negative control, then verify the correction under the original conformance selection and current full gates.
• Keep this issue open while historical attribution remains unknown, even if a separately recorded unchanged run passes.