Function resolve_tunnel_connection 

pub fn resolve_tunnel_connection(
    vps: VpsRecord,
    auth: TunnelAuth,
    config_toml: Option<&Path>,
    replace_host_key: bool,
) -> ConnectionConfig

Builds the connection config for a tunnel from an already-loaded registry record.

G-QA-R02: run_tunnel had dependency injection only for the accept loop, which was the part that needed a socket. Everything between the argument guards and that loop — override application and config assembly — stayed welded to find_by_name, so it could only be exercised against a real host. That is exactly the range where the E3 bug lived: --use-agent and --agent-socket parsed, were dropped on the floor, and a host registered for agent auth simply could not open a tunnel while exec and scp could. Taking the record as an argument makes the whole range testable offline.

The registry’s own timeout is deliberately not consulted: a tunnel is bounded by --timeout-ms, and letting the host record shorten or extend that would make the one-shot deadline depend on state the caller never mentioned.