feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

stream_shared_batch.go

@@ -91,25 +91,24 @@ func writeStreamFastBatchPlain(dst []byte, frames []streamFastDataFrame) error {
 	return nil
 }
 
-func decodeStreamFastBatchPlain(payload []byte) ([]streamFastDataFrame, bool, error) {
+func walkStreamFastBatchPlain(payload []byte, fn func(streamFastDataFrame) error) (bool, error) {
 	if len(payload) < 4 || string(payload[:4]) != streamFastBatchMagic {
-		return nil, false, nil
+		return false, nil
 	}
 	if len(payload) < streamFastBatchHeaderLen {
-		return nil, true, errStreamFastPayloadInvalid
+		return true, errStreamFastPayloadInvalid
 	}
 	if payload[4] != streamFastBatchVersion {
-		return nil, true, errStreamFastPayloadInvalid
+		return true, errStreamFastPayloadInvalid
 	}
 	count := int(binary.BigEndian.Uint32(payload[8:12]))
 	if count <= 0 {
-		return nil, true, errStreamFastPayloadInvalid
+		return true, errStreamFastPayloadInvalid
 	}
-	frames := make([]streamFastDataFrame, 0, count)
 	offset := streamFastBatchHeaderLen
 	for index := 0; index < count; index++ {
 		if len(payload)-offset < streamFastBatchItemHeaderLen {
-			return nil, true, errStreamFastPayloadInvalid
+			return true, errStreamFastPayloadInvalid
 		}
 		flags := payload[offset]
 		dataID := binary.BigEndian.Uint64(payload[offset+4 : offset+12])
@@ -117,29 +116,62 @@ func decodeStreamFastBatchPlain(payload []byte) ([]streamFastDataFrame, bool, er
 		payloadLen := int(binary.BigEndian.Uint32(payload[offset+20 : offset+24]))
 		offset += streamFastBatchItemHeaderLen
 		if dataID == 0 || payloadLen < 0 || len(payload)-offset < payloadLen {
-			return nil, true, errStreamFastPayloadInvalid
+			return true, errStreamFastPayloadInvalid
+		}
+		if fn != nil {
+			if err := fn(streamFastDataFrame{
+				Flags:   flags,
+				DataID:  dataID,
+				Seq:     seq,
+				Payload: payload[offset : offset+payloadLen],
+			}); err != nil {
+				return true, err
+			}
 		}
-		frames = append(frames, streamFastDataFrame{
-			Flags:   flags,
-			DataID:  dataID,
-			Seq:     seq,
-			Payload: payload[offset : offset+payloadLen],
-		})
 		offset += payloadLen
 	}
 	if offset != len(payload) {
-		return nil, true, errStreamFastPayloadInvalid
+		return true, errStreamFastPayloadInvalid
+	}
+	return true, nil
+}
+
+func decodeStreamFastBatchPlain(payload []byte) ([]streamFastDataFrame, bool, error) {
+	frames := make([]streamFastDataFrame, 0, 1)
+	matched, err := walkStreamFastBatchPlain(payload, func(frame streamFastDataFrame) error {
+		frames = append(frames, frame)
+		return nil
+	})
+	if !matched || err != nil {
+		return nil, matched, err
 	}
 	return frames, true, nil
 }
 
-func decodeStreamFastDataFrames(payload []byte) ([]streamFastDataFrame, bool, error) {
-	if frames, matched, err := decodeStreamFastBatchPlain(payload); matched {
-		return frames, true, err
+func walkStreamFastFrames(payload []byte, fn func(streamFastDataFrame) error) (bool, error) {
+	if matched, err := walkStreamFastBatchPlain(payload, fn); matched {
+		return true, err
 	}
 	frame, matched, err := decodeStreamFastDataFrame(payload)
+	if !matched || err != nil {
+		return matched, err
+	}
+	if fn != nil {
+		if err := fn(frame); err != nil {
+			return true, err
+		}
+	}
+	return true, nil
+}
+
+func decodeStreamFastDataFrames(payload []byte) ([]streamFastDataFrame, bool, error) {
+	frames := make([]streamFastDataFrame, 0, 1)
+	matched, err := walkStreamFastFrames(payload, func(frame streamFastDataFrame) error {
+		frames = append(frames, frame)
+		return nil
+	})
 	if !matched || err != nil {
 		return nil, matched, err
 	}
-	return []streamFastDataFrame{frame}, true, nil
+	return frames, true, nil
 }