feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

msg.go

@@ -37,9 +37,10 @@ type Message struct {
 	NetType
 	LogicalConn *LogicalConn
 	// Deprecated: ClientConn aliases LogicalConn for compatibility.
-	ClientConn    *ClientConn
-	TransportConn *TransportConn
-	ServerConn    Client
+	ClientConn              *ClientConn
+	TransportConn           *TransportConn
+	ServerConn              Client
+	inboundTransportProfile *transportProtectionProfile
 	TransferMsg
 	Time        time.Time
 	inboundConn net.Conn
@@ -58,7 +59,7 @@ type messageLogicalTransferSender interface {
 }
 
 type messageInboundTransferSender interface {
-	sendTransferInbound(*LogicalConn, *TransportConn, net.Conn, TransferMsg) error
+	sendTransferInbound(*LogicalConn, *TransportConn, net.Conn, *transportProtectionProfile, TransferMsg) error
 }
 
 func (m *Message) Reply(value MsgVal) (err error) {
@@ -86,7 +87,7 @@ func (m *Message) Reply(value MsgVal) (err error) {
 			if sender == nil {
 				return transportDetachedErrorForPeer(logical, transport)
 			}
-			return sender.sendTransferInbound(logical, transport, m.inboundConn, reply)
+			return sender.sendTransferInbound(logical, transport, m.inboundConn, messageInboundTransportProtectionSnapshot(m), reply)
 		}
 		if transport != nil {
 			_, err = transport.sendTransfer(reply)
@@ -123,12 +124,19 @@ func hydrateServerMessagePeerFields(message Message) Message {
 	if message.LogicalConn == nil {
 		message.LogicalConn = logicalConnFromClient(message.ClientConn)
 	}
-	if message.ClientConn == nil {
+	if message.LogicalConn == nil && message.TransportConn != nil {
+		message.LogicalConn = message.TransportConn.logicalConnSnapshot()
+	}
+	if message.ClientConn == nil && message.LogicalConn != nil {
 		message.ClientConn = message.LogicalConn.compatClientConn()
 	}
 	if message.TransportConn == nil && message.LogicalConn != nil {
 		message.TransportConn = message.LogicalConn.CurrentTransportConn()
 	}
+	if message.inboundConn != nil && message.inboundTransportProfile == nil && message.LogicalConn != nil {
+		profile := message.LogicalConn.transportProtectionProfileSnapshot()
+		message.inboundTransportProfile = &profile
+	}
 	return message
 }
 
@@ -155,3 +163,22 @@ func messageTransportConnSnapshot(message *Message) *TransportConn {
 	}
 	return logical.CurrentTransportConn()
 }
+
+func messageInboundTransportProtectionSnapshot(message *Message) *transportProtectionProfile {
+	if message == nil {
+		return nil
+	}
+	if message.inboundTransportProfile != nil {
+		return message.inboundTransportProfile
+	}
+	if message.inboundConn == nil {
+		return nil
+	}
+	logical := messageLogicalConnSnapshot(message)
+	if logical == nil {
+		return nil
+	}
+	profile := logical.transportProtectionProfileSnapshot()
+	message.inboundTransportProfile = &profile
+	return message.inboundTransportProfile
+}