…nly (#1195)

## Summary

Try the next resolved address when TCP connect fails with ConnectionRefused, HostUnreachable, NetworkUnreachable, or AddrNotAvailable. This allows a reachable address to succeed when an earlier address has no usable route, such as IPv6 on a host with only IPv4 connectivity.

On Windows, also retry WSAEACCES (10013) for the VPN/address-family failure reported in #1184. Rust maps this code to PermissionDenied; matching the raw OS code keeps the exception specific to this socket error.

When all addresses fail, return the last connection failure, including per-address timeouts, instead of a synthesized refusal or an earlier address's I/O error. An expired overall deadline retains its configured timeout reason. Add deterministic tests for fallback, error ordering, timeout precedence, and early termination, alongside error-classification tests.

Fixes #1184.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Martin Algesten <martin@algesten.se>

## Summary

Bypass Agent pool lookup and return when a request's connection settings are incompatible with the Agent configuration. This prevents request-level TLS identities and other connection overrides from borrowing or populating the Agent's pool, while preserving reuse for compatible requests.

Use exhaustive destructuring of Config and TlsConfig so every added field requires an explicit pooling decision. Compare TLS credentials, explicit root sets, and custom crypto providers by shared identity; cloned settings remain compatible. Proxy settings remain separated by the existing pool key, and request-only settings do not disable pooling.