feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

bulk.go

@@ -161,6 +161,7 @@ var (
 	errBulkRangeInvalid         = errors.New("bulk range is invalid")
 	errBulkBackpressureExceeded = errors.New("bulk inbound backpressure exceeded")
 	errBulkDedicatedStreamOnly  = errors.New("dedicated bulk requires stream transport")
+	errBulkDedicatedSingleConn  = errors.New("dedicated bulk requires a dialable additional connection source; ConnectByConn only supports shared transport")
 	errBulkDedicatedActiveLimit = errors.New("dedicated bulk active limit reached")
 )
 
@@ -174,6 +175,9 @@ func clientDedicatedBulkSupportError(c *ClientCommon) error {
 	if source := c.clientConnectSourceSnapshot(); source != nil && source.isUDP() {
 		return errBulkDedicatedStreamOnly
 	}
+	if source := c.clientConnectSourceSnapshot(); source != nil && !source.supportsAdditionalConn() {
+		return errBulkDedicatedSingleConn
+	}
 	return nil
 }