feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

bulk_dedicated_lane_sender_test.go

@@ -7,6 +7,57 @@ import (
 	"time"
 )
 
+func TestBulkDedicatedLaneBatchRequestPrepareBorrowedSharesItems(t *testing.T) {
+	req := getBulkDedicatedLaneBatchRequest()
+	defer req.recycle()
+
+	items := []bulkDedicatedSendRequest{{
+		Type:    bulkFastPayloadTypeData,
+		Seq:     7,
+		Payload: []byte("hello"),
+	}}
+	req.prepare(context.Background(), 11, items, true, true)
+
+	if got, want := len(req.Items), 1; got != want {
+		t.Fatalf("prepared item count = %d, want %d", got, want)
+	}
+	if &req.Items[0] != &items[0] {
+		t.Fatal("prepare with borrowed items should share request items")
+	}
+}
+
+func TestBulkDedicatedLaneSenderTryDirectSubmitWriteFlushesWholePayload(t *testing.T) {
+	conn := &shortWriteBulkRecordConn{maxPerWrite: 1024}
+	encodeCalls := 0
+	sender := &bulkDedicatedLaneSender{
+		conn:   conn,
+		stopCh: make(chan struct{}),
+		encode: func(batches []bulkDedicatedOutboundBatch) ([]byte, func(), error) {
+			encodeCalls++
+			payload, err := encodeBulkDedicatedBatchesPlain(batches)
+			return payload, nil, err
+		},
+	}
+
+	payload := bytes.Repeat([]byte("a"), 3*defaultBulkChunkSize)
+	submitted, written, err := sender.tryDirectSubmitWrite(context.Background(), 9, 1, payload, defaultBulkChunkSize)
+	if err != nil {
+		t.Fatalf("tryDirectSubmitWrite error = %v", err)
+	}
+	if !submitted {
+		t.Fatal("tryDirectSubmitWrite should submit directly")
+	}
+	if got, want := written, len(payload); got != want {
+		t.Fatalf("written = %d, want %d", got, want)
+	}
+	if encodeCalls == 0 {
+		t.Fatal("encode should be called at least once")
+	}
+	if got := sender.queued.Load(); got != 0 {
+		t.Fatalf("queued requests = %d, want 0", got)
+	}
+}
+
 func TestBulkDedicatedLaneSenderCollectBatchRequestsBatchesAcrossDataIDs(t *testing.T) {
 	sender := &bulkDedicatedLaneSender{
 		reqCh:  make(chan *bulkDedicatedLaneBatchRequest, 3),