fix(run_agent): pool socket walk descends into HTTPConnection wrapper

[bkadish]

Problem

The CLOSE-WAIT cleanup added in #4481 (_force_close_tcp_sockets,
_cleanup_dead_connections) walks the httpx pool looking for
conn._network_stream on each pool entry. In httpcore >= 1.0 the
pool contains HTTPConnection wrapper objects whose _network_stream
attribute does not exist — the real stream lives one level deeper at
conn._connection._network_stream, inside the wrapped
HTTP11Connection / HTTP2Connection (see
httpcore/_sync/connection.py
line ~64 and http11.py line ~54).

So the walk silently yields zero sockets and both cleanup functions
become no-ops under any httpx >= 0.25 / httpcore >= 1.0 install. The
log line tcp_force_closed=N always reports 0; pool rebuilds happen
on retry but no surgical socket shutdown ever runs.

Symptom we hit in production

Long-lived gateway processes pointed at a local LLM proxy accumulated
CLOSE-WAIT sockets until httpx's pool handed a dead socket to a new
request. Write succeeded (into kernel send buffer), read hung until
HERMES_STREAM_READ_TIMEOUT, the agent surfaced the
"⚠️ Connection to provider dropped (ReadTimeout). Reconnecting..."
warning every few minutes, and recovery required restarting the
gateway. Exactly the failure #4481 was supposed to prevent.

Fix

• Add _iter_pool_sockets, a single helper that descends through
  conn._connection when present, then unwraps the network stream's
  raw socket. Handles both the sync httpcore backend
  (stream._sock) and the anyio async backend
  (stream._stream.extra(SocketAttribute.raw_socket)).
• Rewrite _force_close_tcp_sockets and _cleanup_dead_connections
  to consume the helper. Behavior is otherwise unchanged.

Verification

Reproduced live against openai.OpenAI(base_url="http://localhost:3456/v1")
on httpx 0.28.1 / httpcore 1.0.9:

upstream walk found: 0    # pre-fix code from main
sockets found: 1          # this PR

The recovered socket is the actual socket.socket object backing the
client's keep-alive connection — shutdown(SHUT_RDWR) + close()
on it now does what the original commit message promised.

Notes

• No behavior change when the walk did work (older httpcore, exotic
  transports) — the helper falls back to the same attribute names the
  original code tried.
• No new dependency on anyio: the import is inside a try block, only
  attempted when the sync _sock path returns nothing.