feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

client_connect_source.go

@@ -18,14 +18,18 @@ const (
 var errClientReconnectSourceUnavailable = errors.New("client reconnect source is unavailable")
 
 type clientConnectSource struct {
-	kind    string
-	network string
-	addr    string
-	dialFn  func(context.Context) (net.Conn, error)
+	kind               string
+	network            string
+	addr               string
+	dialFn             func(context.Context) (net.Conn, error)
+	supportsAdditional bool
 }
 
 func newClientConnConnectSource(conn net.Conn) *clientConnectSource {
-	source := &clientConnectSource{kind: clientConnectSourceConn}
+	source := &clientConnectSource{
+		kind:               clientConnectSourceConn,
+		supportsAdditional: false,
+	}
 	if conn == nil {
 		return source
 	}
@@ -43,9 +47,10 @@ func newClientConnConnectSource(conn net.Conn) *clientConnectSource {
 
 func newClientNetworkConnectSource(network string, addr string) *clientConnectSource {
 	return &clientConnectSource{
-		kind:    clientConnectSourceNetwork,
-		network: network,
-		addr:    addr,
+		kind:               clientConnectSourceNetwork,
+		network:            network,
+		addr:               addr,
+		supportsAdditional: true,
 		dialFn: func(context.Context) (net.Conn, error) {
 			return transport.Dial(network, addr)
 		},
@@ -54,9 +59,10 @@ func newClientNetworkConnectSource(network string, addr string) *clientConnectSo
 
 func newClientTimeoutConnectSource(network string, addr string, timeout time.Duration) *clientConnectSource {
 	return &clientConnectSource{
-		kind:    clientConnectSourceTimeout,
-		network: network,
-		addr:    addr,
+		kind:               clientConnectSourceTimeout,
+		network:            network,
+		addr:               addr,
+		supportsAdditional: true,
 		dialFn: func(context.Context) (net.Conn, error) {
 			return transport.DialTimeout(network, addr, timeout)
 		},
@@ -65,8 +71,9 @@ func newClientTimeoutConnectSource(network string, addr string, timeout time.Dur
 
 func newClientFactoryConnectSource(dialFn func(context.Context) (net.Conn, error)) *clientConnectSource {
 	return &clientConnectSource{
-		kind:   clientConnectSourceFactory,
-		dialFn: dialFn,
+		kind:               clientConnectSourceFactory,
+		dialFn:             dialFn,
+		supportsAdditional: true,
 	}
 }
 
@@ -82,6 +89,10 @@ func (s *clientConnectSource) canReconnect() bool {
 	return s != nil && s.dialFn != nil
 }
 
+func (s *clientConnectSource) supportsAdditionalConn() bool {
+	return s != nil && s.supportsAdditional
+}
+
 func (s *clientConnectSource) isUDP() bool {
 	if s == nil {
 		return false