After terminating at the LTM to do mutual auth can you insert the client cert into the tcp header

Sure, you can use this method to attempt to get the certificate from CLIENTSSL_CLIENTCERT, if that fails you can extract it from HTTP_REQUEST.

proc getCert {} {
    if {[SSL::cert count] > 0} {
         validate certificate 0 = OK
        if {[SSL::verify_result] == 0} {
            set cert [X509::whole [SSL::cert 0]]
        } else {
            set result ERROR
        }
    } else {
        set result ERROR
    }
    return $result
}

when CLIENTSSL_CLIENTCERT priority 100 {
     validate and get retrieve certificate
    set x509certificate [call getCert]
}

when HTTP_REQUEST priority 100 {
    if {!([info exists x509certificate])} {
        set x509certificate [call getCert]
    }
    if {$x509certificate eq "ERROR"} {
        log local0. "[IP::client_addr]:[TCP::client_port] Bad certificate, rejecting connection"
        HTTP::respond 403 content "Connection forbidden - invalid certificate"
        return
    } else {
        log local0. "[IP::client_addr]:[TCP::client_port] Client Certificate Accepted, inserting header"
        HTTP::header insert SSL_X509 $x509certificate
    }
}