client: skip poll when TLS plaintext is buffered; surface poll errors
Addresses review: a prior read can decrypt more than the caller consumed, leaving
plaintext in the TLS client's buffer while the socket is empty, so polling the fd
would spuriously time out and starve buffered data. Check reader.bufferedLen()
first. A poll failure is surfaced as a read failure (mapped into the fill error
set) rather than swallowed.