feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

server_inbound_reply_test.go

@@ -3,12 +3,54 @@ package notify
 import (
 	"b612.me/stario"
 	"context"
+	"errors"
 	"math"
 	"net"
 	"testing"
 	"time"
 )
 
+func readServerEnvelopeFromConnWithProfile(t *testing.T, server *ServerCommon, profile transportProtectionProfile, conn net.Conn, timeout time.Duration) Envelope {
+	t.Helper()
+
+	queue := stario.NewQueue()
+	deadline := time.Now().Add(timeout)
+	buf := make([]byte, 4096)
+	for time.Now().Before(deadline) {
+		if err := conn.SetReadDeadline(deadline); err != nil {
+			t.Fatalf("SetReadDeadline failed: %v", err)
+		}
+		n, err := conn.Read(buf)
+		if n > 0 {
+			if parseErr := queue.ParseMessage(buf[:n], "server-inbound-profile"); parseErr != nil {
+				t.Fatalf("ParseMessage failed: %v", parseErr)
+			}
+			select {
+			case msg := <-queue.RestoreChan():
+				plain, decErr := decryptTransportPayloadCodec(profile.mode, profile.runtime, profile.msgDe, profile.secretKey, msg.Msg)
+				if decErr != nil {
+					t.Fatalf("decryptTransportPayloadCodec failed: %v", decErr)
+				}
+				env, decErr := server.decodeEnvelopePlain(plain)
+				if decErr != nil {
+					t.Fatalf("decodeEnvelopePlain failed: %v", decErr)
+				}
+				return env
+			default:
+			}
+		}
+		if err == nil {
+			continue
+		}
+		if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
+			break
+		}
+		t.Fatalf("conn Read failed: %v", err)
+	}
+	t.Fatal("timed out waiting for server envelope")
+	return Envelope{}
+}
+
 func TestMessageReplyUsesInboundConnForStaleTransport(t *testing.T) {
 	server := NewServer().(*ServerCommon)
 	UseLegacySecurityServer(server)
@@ -85,6 +127,64 @@ func TestMessageReplyUsesInboundConnForStaleTransport(t *testing.T) {
 	}
 }
 
+func TestMessageReplyUsesInboundProtectionSnapshotAfterLogicalSwitch(t *testing.T) {
+	secret := []byte("correct horse battery staple")
+	alternate, err := deriveModernPSKProtectionProfile([]byte("notify-reply-snapshot-alternate"), testModernPSKOptions(), ProtectionManaged)
+	if err != nil {
+		t.Fatalf("deriveModernPSKProtectionProfile failed: %v", err)
+	}
+	handlerErr := make(chan error, 1)
+	server := newRunningPeerAttachServerForTest(t, func(server *ServerCommon) {
+		if err := UseModernPSKServer(server, secret, testModernPSKOptions()); err != nil {
+			t.Fatalf("UseModernPSKServer failed: %v", err)
+		}
+		server.SetLink("reply-snapshot", func(msg *Message) {
+			if msg == nil || msg.LogicalConn == nil {
+				select {
+				case handlerErr <- errors.New("reply-snapshot logical is nil"):
+				default:
+				}
+				return
+			}
+			msg.LogicalConn.applyTransportProtectionProfile(alternate)
+			if err := msg.Reply([]byte("ack")); err != nil {
+				select {
+				case handlerErr <- err:
+				default:
+				}
+			}
+		})
+	})
+	client := NewClient().(*ClientCommon)
+	if err := UseModernPSKClient(client, secret, testModernPSKOptions()); err != nil {
+		t.Fatalf("UseModernPSKClient failed: %v", err)
+	}
+
+	left, right := net.Pipe()
+	defer right.Close()
+	bootstrapPeerAttachConnForTest(t, server, right)
+	if err := client.ConnectByConn(left); err != nil {
+		t.Fatalf("ConnectByConn failed: %v", err)
+	}
+	defer func() {
+		client.setByeFromServer(true)
+		_ = client.Stop()
+	}()
+
+	reply, err := client.SendWait("reply-snapshot", []byte("ping"), time.Second)
+	if err != nil {
+		t.Fatalf("SendWait failed: %v", err)
+	}
+	if got, want := string(reply.Value), "ack"; got != want {
+		t.Fatalf("reply value = %q, want %q", got, want)
+	}
+	select {
+	case err := <-handlerErr:
+		t.Fatalf("reply-snapshot handler failed: %v", err)
+	default:
+	}
+}
+
 func TestServerHandleReceivedSignalReliabilityUsesInboundConnForStaleTransport(t *testing.T) {
 	server := NewServer().(*ServerCommon)
 	UseLegacySecurityServer(server)