feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

client_config.go

@@ -65,32 +65,40 @@ func (c *ClientCommon) RecoverTransferSnapshots(ctx context.Context) error {
 }
 
 func (c *ClientCommon) GetMsgEn() func([]byte, []byte) []byte {
-	return c.msgEn
+	return c.clientTransportProtectionSnapshot().msgEn
 }
 
 // Deprecated: SetMsgEn overrides the transport codec directly.
 // Prefer UseModernPSKClient or UseLegacySecurityClient.
 func (c *ClientCommon) SetMsgEn(fn func([]byte, []byte) []byte) {
-	c.msgEn = fn
-	c.fastStreamEncode = nil
-	c.fastBulkEncode = nil
-	c.fastPlainEncode = nil
-	c.modernPSKRuntime = nil
+	profile := c.clientTransportProtectionSnapshot()
+	profile.mode = ProtectionManaged
+	profile.msgEn = fn
+	profile.fastStreamEncode = nil
+	profile.fastBulkEncode = nil
+	profile.fastPlainEncode = nil
+	profile.runtime = nil
+	c.setClientTransportProtectionProfile(profile)
+	c.clearClientSecurityProfiles()
 	c.securityReadyCheck = false
 }
 
 func (c *ClientCommon) GetMsgDe() func([]byte, []byte) []byte {
-	return c.msgDe
+	return c.clientTransportProtectionSnapshot().msgDe
 }
 
 // Deprecated: SetMsgDe overrides the transport codec directly.
 // Prefer UseModernPSKClient or UseLegacySecurityClient.
 func (c *ClientCommon) SetMsgDe(fn func([]byte, []byte) []byte) {
-	c.msgDe = fn
-	c.fastStreamEncode = nil
-	c.fastBulkEncode = nil
-	c.fastPlainEncode = nil
-	c.modernPSKRuntime = nil
+	profile := c.clientTransportProtectionSnapshot()
+	profile.mode = ProtectionManaged
+	profile.msgDe = fn
+	profile.fastStreamEncode = nil
+	profile.fastBulkEncode = nil
+	profile.fastPlainEncode = nil
+	profile.runtime = nil
+	c.setClientTransportProtectionProfile(profile)
+	c.clearClientSecurityProfiles()
 	c.securityReadyCheck = false
 }
 
@@ -103,20 +111,24 @@ func (c *ClientCommon) SetHeartbeatPeroid(duration time.Duration) {
 }
 
 func (c *ClientCommon) GetSecretKey() []byte {
-	return c.SecretKey
+	return c.clientTransportProtectionSnapshot().secretKey
 }
 
 // Deprecated: SetSecretKey injects a raw transport key directly.
 // Prefer UseModernPSKClient or UseLegacySecurityClient.
 func (c *ClientCommon) SetSecretKey(key []byte) {
-	c.SecretKey = key
+	profile := c.clientTransportProtectionSnapshot()
+	profile.mode = ProtectionManaged
+	profile.secretKey = cloneTransportProtectionKey(key)
 	if len(key) == 0 {
-		c.modernPSKRuntime = nil
+		profile.runtime = nil
 	} else if runtime, err := newModernPSKCodecRuntime(key, defaultModernPSKAAD); err == nil {
-		c.modernPSKRuntime = runtime
+		profile.runtime = runtime
 	} else {
-		c.modernPSKRuntime = nil
+		profile.runtime = nil
 	}
+	c.setClientTransportProtectionProfile(profile)
+	c.clearClientSecurityProfiles()
 	c.securityReadyCheck = len(key) == 0
 	c.skipKeyExchange = true
 }