fix(#20): heid-bug-hunt fixups — probe ConnectFailed + adapter finite-PAD (slice-3)

The slice-3 heid-bug-hunt panel (3/3) caught a real regression the cutover
introduced, plus a chokepoint-invariant gap:

- ConnectFailed escaped both rewired CLI probes. When --set-persona-pad and
  --seed-first-message moved off raw httpx onto the wt adapter, transport failures
  changed class: the SDK normalizes any pre-response transport error to
  worldtree_sdk.ConnectFailed (request.py), a WorldtreeError (not ApiError), so it
  passed the adapter unmapped AND the probes' httpx-only except tuples → an uncaught
  traceback instead of the graceful [network_error] exit 21. _amain (slice-2) already
  handled it; the probes lagged. Fix: add ConnectFailed to both probe except tuples
  (mirrors _amain). Live-verified at a refused host → [network_error] exit 21.

- Finite-PAD enforced only at the CLI, not the adapter chokepoint. wt.set_persona_state
  delegated finiteness to the caller (documented), so a direct/non-CLI caller passing
  nan/inf got a raw SDK ConfigurationError. Fix: assert finiteness in the adapter
  precondition (consistent with its other precondition asserts) so the invariant holds
  at the chokepoint in ratatoskr's own terms; the CLI pre-check stays for the friendly
  usage error.

Triaged-and-declined (all correct per the panel + Heid's source-check): the deleted
sessions.py exports (intended no-shim cutover, zero un-migrated importers), the
session["session_id"] index (accept-known-risk, matches --new), and Regin's "web
indefinite block" (refuted — the seed is asyncio.wait_for-bounded). The concurrent
heid-code-review panel returned zero drift, no code change.

TDD: 3 RED tests (both probes' ConnectFailed → exit 21; adapter nan/inf/-inf →
AssertionError, never reaches the SDK) → GREEN. Suite 469; ruff clean; mypy no new errors.

tests/test_cli.py

@@ -1950,6 +1950,20 @@ class TestTier2Probes:
         )
         assert rc == 10
 
+    @respx.mock
+    def test_set_persona_probe_connect_failed(self, capsys: pytest.CaptureFixture[str]) -> None:
+        """connect_failed [error-path]: a transport failure the SDK normalizes to
+        ConnectFailed → graceful [network_error], exit 21 (not an uncaught crash)."""
+        respx.post("https://w.example/sessions/s1/persona_state").mock(
+            side_effect=httpx.ConnectError("refused")
+        )
+        rc = main(
+            ["--set-persona-pad", "0.4,0.1,-0.2", "--session", "s1",
+             "--api-key", "k", "--server", "https://w.example"]
+        )
+        assert rc == 21
+        assert "[network_error]" in capsys.readouterr().err
+
 
 class TestSeedFirstMessageProbe:
     """--seed-first-message one-shot (#347 authored-history-write reference-consumer probe)."""
@@ -2066,3 +2080,17 @@ class TestSeedFirstMessageProbe:
         assert rc == 0
         assert "feature-absent" in capsys.readouterr().out
         assert msgs_route.call_count == 0  # never capability-probes past the 404
+
+    @respx.mock
+    def test_seed_probe_connect_failed(self, capsys: pytest.CaptureFixture[str]) -> None:
+        """connect_failed [error-path]: a transport failure on create that the SDK
+        normalizes to ConnectFailed → graceful [network_error], exit 21."""
+        respx.post("https://w.example/sessions").mock(
+            side_effect=httpx.ConnectError("refused")
+        )
+        rc = main(
+            ["--seed-first-message", "hello", "--agent", "mimir",
+             "--api-key", "k", "--server", "https://w.example"]
+        )
+        assert rc == 21
+        assert "[network_error]" in capsys.readouterr().err