fix(connector): make certificate pinning real; disable Nagle

Security: with --verify-hostname off (the default), the old NoVerify
verifier accepted ANY server certificate — the CA loaded from --tls-ca
was never consulted, so the documented pinning was a no-op and the
connection was trivially MITM-able. Replace it with PinnedCertVerifier:
the presented end-entity cert must be byte-identical to a cert in the
--tls-ca file (any cert in a multi-cert PEM matches, supporting
rotation). Signature validation now uses the ring provider's full
algorithm set instead of a hardcoded 3-scheme list. Empty PEM files
fail fast instead of failing closed per-handshake.

The --verify-hostname path is unchanged (WebPki root-store validation).

Also: the third argument of connect_async_tls_with_config is
tungstenite's disable_nagle flag, not a verification toggle — we were
passing verify_hostname there, leaving Nagle ON for default users. Pass
true unconditionally, and disable Nagle on the plain ws:// path too;
socktop exchanges small request/response frames where Nagle only adds
latency.

Client now consumes the connector via a dual path+version dep so these
fixes are in local builds and CI before the crates.io publish (cargo
strips the path on publish). Connector version -> 1.51.0.

Verified E2E: agent A's cert connects to agent A; agent B's cert
against agent A fails the handshake (the rpi-worker-1 wrong-PEM
scenario); --verify-hostname against a 127.0.0.1 SAN still connects.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Cargo.lock

@@ -2422,7 +2422,7 @@ dependencies = [
  "ratatui",
  "serde",
  "serde_json",
- "socktop_connector 1.50.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "socktop_connector",
  "tempfile",
  "tokio",
  "unicode-width",
@@ -2462,7 +2462,7 @@ dependencies = [
 
 [[package]]
 name = "socktop_connector"
-version = "1.50.0"
+version = "1.51.0"
 dependencies = [
  "flate2",
  "futures-util",
@@ -2483,27 +2483,6 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "socktop_connector"
-version = "1.50.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61ea6a5733e71da6d5c94d23265b85f7041305bca51e6c33e7104464444047bc"
-dependencies = [
- "flate2",
- "futures-util",
- "prost",
- "prost-build",
- "protoc-bin-vendored",
- "rustls",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "thiserror 2.0.17",
- "tokio",
- "tokio-tungstenite 0.24.0",
- "url",
-]
-
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"