Function plan_connector 

fn plan_connector(
    mode: SslMode,
    sslrootcert: Option<&Path>,
    host: &str,
    hunt_candidates: &[&Path],
    ca_exists: impl Fn(&Path) -> bool,
) -> Result<ConnectorSpec, ConnectionError>

Plan the TLS setup for a connection from the resolved (mode, CA) inputs.

Pure: does no network I/O and — aside from the injected ca_exists predicate — does no filesystem I/O. Returns a ConnectorSpec that build_connector then materializes into an OpenSSL context.

hunt_candidates is the ordered list of default CA paths to probe when sslrootcert is not set. In production this is DEFAULT_CA_PATHS; tests pass their own list plus a stubbed ca_exists predicate.