Rig gaps found in the 2026-09-24 hardware runs: live rig can't run on comb, banner rig burns its budget on handshake failure, bad_finished doesn't print the carry

[JC-000]

Found by the pre-merge hardware runner. Each item is small; split them out if they're picked up separately.

1. `rig_https_live.py` cannot run on a uci-comb image. It allocates a 256 B trampoline from the CRYPTO_OVERLAY tail, which is 126 B on comb, so the MemoryArbiter refuses it. Same root cause as uci-comb has no offline handshake rig — rig_https_local cannot allocate scratch on it #209 (rig_https_local on comb). The live comb run was done through the banner rig instead.
2. `rig_https_banner.py` burns its full fetch budget on a handshake failure. rig_https_banner: stop polling once a truncation is decided (#226) #232's early stop only engages once the response has reached the body (parse_state ≥ 2). The close wait also never sees the "CONNECTION CLOSED" marker on that path. A handshake failure (e.g. the Intermittent UCI handshake stall after a good connect: tls_state=3, read_seq=0, ~707 B consumed, ring empty, net_last_error=$00 #242 stall) therefore costs the whole budget. Consider stopping once tls_state=$FF, or once the TLS HANDSHAKE FAILED marker is seen.
3. `rig_https_bad_finished.py` latches `http_get`'s carry byte but never prints it. The value is captured, and its absence from the output makes runs harder to audit.

Also noted, for #211/#239 follow-up: during a frozen #211 stall on master-based images, the record buffer at $A000 kept changing while the body counter stayed frozen. That is consistent with records arriving and failing to authenticate, which is what PR #240 makes fail closed.

🤖 Generated with Claude Code