feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

server_inbound_source.go

@@ -93,26 +93,34 @@ func (s *ServerCommon) pushTransportPayloadSourceFast(payload []byte, release fu
 		}
 		return true
 	}
-	if s.tryDispatchBorrowedBulkTransportPayload(source, payload) {
+	logical, transport := s.resolveInboundSource(source)
+	if logical == nil {
 		if release != nil {
 			release()
 		}
 		return true
 	}
-	owned := append([]byte(nil), payload...)
-	if release != nil {
-		release()
+	plain, plainRelease, err := s.decryptTransportPayloadLogicalPooled(logical, payload, release)
+	if err != nil {
+		if s.showError || s.debugMode {
+			fmt.Println("server decode transport payload error", err)
+		}
+		return true
+	}
+	inboundConn := serverInboundConn(source)
+	if s.tryDispatchBorrowedTransportPlain(logical, transport, inboundConn, plain, plainRelease) {
+		return true
+	}
+	owned := plain
+	if plainRelease != nil {
+		owned = append([]byte(nil), plain...)
+		plainRelease()
 	}
 	s.wg.Add(1)
 	if !dispatcher.Dispatch(serverInboundDispatchSource(source), func() {
 		defer s.wg.Done()
-		logical, transport := s.resolveInboundSource(source)
-		if logical == nil {
-			return
-		}
 		now := time.Now()
-		inboundConn := serverInboundConn(source)
-		if err := s.dispatchInboundTransportPayload(logical, transport, inboundConn, owned, now); err != nil && (s.showError || s.debugMode) {
+		if err := s.dispatchInboundTransportPlain(logical, transport, inboundConn, owned, now); err != nil && (s.showError || s.debugMode) {
 			fmt.Println("server decode envelope error", err)
 		}
 	}) {