feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

bulk_dispatcher.go

@@ -162,7 +162,8 @@ func (c *ClientCommon) tryDispatchBorrowedBulkTransportPayload(payload []byte) b
 	if c == nil || len(payload) == 0 {
 		return false
 	}
-	plain, plainRelease, err := decryptTransportPayloadCodecOwnedPooled(c.modernPSKRuntime, c.msgDe, c.SecretKey, payload)
+	profile := c.clientTransportProtectionSnapshot()
+	plain, plainRelease, err := decryptTransportPayloadCodecOwnedPooled(profile.mode, profile.runtime, profile.msgDe, profile.secretKey, payload)
 	if err != nil {
 		if c.showError || c.debugMode {
 			fmt.Println("client decode transport payload error", err)
@@ -194,7 +195,7 @@ func (s *ServerCommon) tryDispatchBorrowedBulkTransportPayload(source interface{
 	if logical == nil {
 		return false
 	}
-	plain, plainRelease, err := decryptTransportPayloadCodecOwnedPooled(logical.modernPSKRuntimeSnapshot(), logical.msgDeSnapshot(), logical.secretKeySnapshot(), payload)
+	plain, plainRelease, err := decryptTransportPayloadCodecOwnedPooled(logical.protectionModeSnapshot(), logical.modernPSKRuntimeSnapshot(), logical.msgDeSnapshot(), logical.secretKeySnapshot(), payload)
 	if err != nil {
 		if s.showError || s.debugMode {
 			fmt.Println("server decode transport payload error", err)