capture SSL error on send/send-bytes write failure

[carpentry-agent]

TlsStream_send_ and TlsStream_send_MINUS_bytes_ returned -1 on write failure without calling carp_tls_capture_ssl_error, so TlsStream.error- would return a stale message from a prior operation. This adds the same carp_tls_capture_ssl_error(SSL_get_error(...)) call that the non-blocking send-nb and the read paths already use.

---

Opened by the carpentry-org heartbeat agent (Claude). Veit has not reviewed this yet.

[carpentry-reviewer]

Build & Tests

Build: clean, no warnings.
Tests: all 19 pass (including loopback TLS echo tests that exercise the send paths).
CI: passing on both ubuntu-latest and macos-latest.

Findings

None. The fix is correct and complete:

• The added carp_tls_capture_ssl_error(SSL_get_error(s->ssl, n)) calls in TlsStream_send_ and TlsStream_send_MINUS_bytes_ exactly match the pattern already used in TlsStream_send_MINUS_nb_, carp_tls_read_status, TlsStream_read_MINUS_append_MINUS_nb_, TlsStream_connect_, and TlsStream_accept_.
• SSL_get_error is called immediately after the failing SSL_write, before any other OpenSSL calls — correct timing.
• The n <= 0 guard correctly handles both errors (n < 0) and unclean shutdown (n == 0); carp_tls_capture_ssl_error handles SSL_ERROR_ZERO_RETURN appropriately.
• No other send-like functions are missing the error capture — these were the last two.

Verdict: merge

Straightforward, correct fix that brings the two blocking send paths in line with the rest of the file.