feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

bulk_batch_sender.go

@@ -418,18 +418,18 @@ func (s *bulkBatchSender) flush(requests []bulkBatchRequest) error {
 		}
 	}()
 	writeTimeout := s.transportWriteTimeout()
+	frames := make([][]byte, 0, len(payloads))
+	payloadBytes := 0
 	for _, payload := range payloads {
-		frame := payload.payload
-		started := time.Now()
-		err := s.binding.withConnWriteLockDeadline(writeDeadlineFromTimeout(writeTimeout), func(conn net.Conn) error {
-			return writeFramedPayloadUnlocked(conn, queue, frame)
-		})
-		s.binding.observeBulkAdaptivePayloadWrite(len(frame), time.Since(started), writeTimeout, err)
-		if err != nil {
-			return err
-		}
+		frames = append(frames, payload.payload)
+		payloadBytes += len(payload.payload)
 	}
-	return nil
+	started := time.Now()
+	err = s.binding.withConnWriteLockDeadline(writeDeadlineFromTimeout(writeTimeout), func(conn net.Conn) error {
+		return writeFramedPayloadBatchUnlocked(conn, queue, frames)
+	})
+	s.binding.observeBulkAdaptivePayloadWrite(payloadBytes, time.Since(started), writeTimeout, err)
+	return err
 }
 
 func (s *bulkBatchSender) encodeRequests(requests []bulkBatchRequest) ([]bulkBatchEncodedPayload, error) {