libSceSsl: the six connection calls are absent (Dying Light 2's ffmpeg.prx); branch ready, three complete and three throwing #3766

libSceSsl lacks the six connection calls sceSslCreateConnection (tuscfitnhEo), sceSslDeleteConnection (zXvd6iNyfgc), sceSslSetVerifyCallback (jltWpVKtetg), sceSslConnect (iNjkt9Poblw), sceSslRead (HJ1n138CQ2g) and sceSslWrite (E4a-ahM57QQ). Dying Light 2's ffmpeg.prx imports all six (#1794, section 3, loader table row for ffmpeg), so the module cannot load.

Branch ready: screamm:feat/ssl-connection-calls (2b98f187, one commit on main a11c8f7f). I cannot open it as a PR because of the intake check; anyone eligible is welcome to carry it, keeping the commit as is. Three of the six are complete and three throw, because the repository has no TLS client at all (libSceHttp has none either).

• Complete: sceSslCreateConnection(ctx, sock, host) records the context, socket and host and returns an id from the same counter as sceSslInit (SSL_ERROR_INVALID_ID 0x8095F006 for an unknown context, inferred from the measured behaviour of the other context calls; a null host throws); sceSslDeleteConnection drops it and returns 0, leaving the socket open, also after sceSslTerm; sceSslSetVerifyCallback stores the callback and argument (null accepted) and returns 0. Signatures and the "already connected socket, socket stays open after delete" facts from SharpProspero Interop/Net/Http.cs (fact only, GPL-3.0); the error code and names from the console measurement in commit 7e5a34c5, KytyPS5 network.cpp/errno.h and sharpemu SslExports.cs.
• Throwing after the id validation: sceSslConnect, sceSslRead, sceSslWrite, with a message naming the host and the socket's peer port through sceNetGetpeername (new link dependency libSceSsl → libSceNet, as libScePosixForWebKit already has), or host (socket N has no peer). Unknown ids throw (no console codes). Recorded in TechnicalDebt. After this, Dying Light 2 stops where ffmpeg.prx first calls sceSslConnect, unless its own Net_StartUp failed assert comes first.
• guest_ssl covers the null host, the unknown context, a loopback TCP connection where the three calls throw naming example.com:<port>, an unconnected socket, unknown ids in all five id-taking calls, and the behaviour after sceSslTerm.

Tested on Windows 11 Pro 26220, WinLibs MinGW-w64 GCC 15.2.0 r7, Ninja, Release, BUILD_TESTING=ON, full build including libs: guest_ssl and guest_memory_pool_stats 3/3; ctest -j8 -E "^agc_driver_|^video_out_flip" 533/536, the failures being the known windows_exceptions (#3411, fixed by #3415), guest_kernel_sys (#3510) and guest_filesystem (#3518); tools/check_conventions.py --base main and git diff --check pass. Not run on Linux.

Written with Claude Code assistance (implementation by a subagent, reviewed and validated in this session).