feat(docker): re-enable tcp+tls:// scheme now that TLS plumbing has landed (#616)

[CybotTM]

Summary

Re-enables the tcp+tls:// DOCKER_HOST scheme that was dropped from the allow-list by #612 while waiting for the TLS-plumbing fix. The plumbing landed in #613 — createHTTPClient already routes "https" and "tcp+tls" through the same TLS-aware arm via applyDockerTLS, and TestCreateHTTPClient_TCPPlusTLSEnablesTLS (#613) pins that contract. The silent-downgrade risk that justified the temporary rejection is therefore closed.

Changes

• core/adapters/docker/client.go: re-add "tcp+tls" to supportedDockerHostSchemes; refresh the allow-list / switch-arm comments to reflect the new state.
• core/adapters/docker/client_mutation_test.go:
  • Drop tcp_plus_tls_scheme from TestNewClientWithConfig_UnsupportedSchemes.
  • Add tcp_plus_tls_lowercase and tcp_plus_tls_uppercase (case-normalization) to the accept table in TestValidateAndNormalizeHost.
  • New TestNewClientWithConfig_TCPPlusTLSScheme: asserts that NewClientWithConfig(Host: "tcp+tls://127.0.0.1:0") does NOT return ErrUnsupportedDockerHostScheme (any unrelated dial / negotiate error is acceptable — the test only pins scheme acceptance).
• docs/TROUBLESHOOTING.md: tcp+tls:// row added back to the supported schemes table; pending-PR note removed from the unsupported list.
• CHANGELOG.md: new ### Added entry under [Unreleased]; remove the now-stale "tcp+tls:// rejected pending fix(docker): honor DOCKER_TLS_VERIFY/DOCKER_CERT_PATH env vars (#607) #613" note from the existing fix(docker): validate DOCKER_HOST scheme and reject unsupported transports (#609) #612 ### Changed entry.

Pure additive — no other code paths touched, validateAndNormalizeHost signature unchanged.

Fixes #616.

Test plan

• go test -race ./core/adapters/docker/ — passes locally (5.6s)
• golangci-lint run --timeout=3m — 0 issues (full project)
• New positive test TestNewClientWithConfig_TCPPlusTLSScheme exercises the allow-list change
• Existing TestCreateHTTPClient_TCPPlusTLSEnablesTLS (from fix(docker): honor DOCKER_TLS_VERIFY/DOCKER_CERT_PATH env vars (#607) #613) still asserts the TLS material is wired
• CI green

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[github-actions]

⚠️ Mutation Testing Results

Mutation Score: 0.00% (threshold: 60%)

⚠️ Score is below threshold. Consider improving test coverage or test quality.

What is mutation testing?

Mutation testing measures test quality by introducing small changes (mutations) to the code and checking if tests detect them. A higher score means better test effectiveness.

• Killed mutants: Tests caught the mutation (good!)
• Survived mutants: Tests missed the mutation (needs improvement)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.38%. Comparing base (d014841) to head (718490d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #625   +/-   ##
=======================================
  Coverage   87.38%   87.38%           
=======================================
  Files          88       88           
  Lines       10722    10722           
=======================================
  Hits         9369     9369           
  Misses       1112     1112           
  Partials      241      241           

Flag	Coverage Δ
integration	87.34% <ø> (-0.04%)	⬇️
unittests	84.14% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[Copilot]

Pull request overview

Re-enables the tcp+tls:// DOCKER_HOST scheme in Ofelia’s Docker adapter now that TLS material is correctly applied to the custom HTTP transport (per the prior TLS plumbing work).

Changes:

• Re-add tcp+tls to the DOCKER_HOST scheme allow-list and update related inline comments.
• Update unit tests to treat tcp+tls:// as supported (including scheme case-normalization coverage) and add a targeted allow-list acceptance test.
• Refresh operator-facing documentation and changelog entries to reflect tcp+tls:// support.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
core/adapters/docker/client.go	Re-adds tcp+tls to supported schemes and updates scheme/transport commentary.
core/adapters/docker/client_mutation_test.go	Adjusts scheme validation tests and adds a new tcp+tls:// acceptance test.
docs/TROUBLESHOOTING.md	Reintroduces tcp+tls:// in the supported schemes table and removes the “pending” note.
CHANGELOG.md	Documents the re-enabled scheme under Unreleased and removes the stale “pending TLS plumbing” note.

[gemini-code-assist]

Code Review

This pull request re-enables the tcp+tls:// scheme for DOCKER_HOST validation, following the implementation of necessary TLS plumbing. It updates the allow-list, documentation, and test suites to reflect this change. One piece of feedback was provided regarding the documentation for the tcp scheme: while the code enables HTTP/2 during auto-upgrades to TLS, the comments still stated that HTTP/2 was not supported for that scheme.