http: custom TLS uploads retain one transport per attempt

Problem

HTTP and Artifactory uploads configured with trusted_certificates or client-certificate settings construct a fresh transport for every artifact attempt. Request execution calls the client factory each time, including retries. Those custom transports have no idle timeout or owner cleanup.

Evidence

Independent local TLS tests exercised both real publishing pipes with three sequential artifacts. Production created three TCP connections and TLS handshakes; one retry per artifact created six. Equivalent shared-client controls used one connection in either case, with matching payloads, authentication, headers, and TLS verification. Custom idle connections remained after publication, context cancellation, and GC, until explicit server cleanup. Empty responses excluded unread response bodies as the cause. Client-certificate and trusted-certificate cases were covered. These are connection/resource observations, not a wall-time benchmark or public-service failure.

Correction

Share one client per upload configuration, then close only its owned custom transport after all workers finish, including error paths. Do not close the borrowed default client or share credentials across configurations. Add local regressions for connection reuse, retries, retained TLS/authentication behavior, and owned-resource cleanup.

---

Audit priority: P2.

Audit source revision: 628c889d7. AI disclosure: this report comes from a Copilot-assisted audit, with discovery by caarlos0 agents and independent verification by anvil agents. Reproduction methods and limits are stated above; no fix is included in this issue.