feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

transport_write_test.go

@@ -143,6 +143,43 @@ func TestStreamBatchSenderRespectsBindingWriteDeadlineWhenReceiverStalls(t *test
 	}
 }
 
+func TestBulkBatchSenderFlushAggregatesAdaptivePayloadObservation(t *testing.T) {
+	conn := &delayedWriteConn{delay: 20 * time.Millisecond}
+	binding := newTransportBinding(conn, stario.NewQueue())
+	sender := newTestBulkBatchSender(binding)
+	payloadA := bytes.Repeat([]byte("a"), 128*1024)
+	payloadB := bytes.Repeat([]byte("b"), 128*1024)
+
+	err := sender.flush([]bulkBatchRequest{
+		{
+			ctx: context.Background(),
+			frames: []bulkFastFrame{{
+				Type:    bulkFastPayloadTypeData,
+				DataID:  1,
+				Seq:     1,
+				Payload: payloadA,
+			}},
+			fastPathVersion: bulkFastPathVersionV1,
+		},
+		{
+			ctx: context.Background(),
+			frames: []bulkFastFrame{{
+				Type:    bulkFastPayloadTypeData,
+				DataID:  2,
+				Seq:     1,
+				Payload: payloadB,
+			}},
+			fastPathVersion: bulkFastPathVersionV1,
+		},
+	})
+	if err != nil {
+		t.Fatalf("flush failed: %v", err)
+	}
+	if got, want := binding.bulkAdaptiveSoftPayloadBytesSnapshot(), bulkAdaptiveSoftPayloadMinBytes; got != want {
+		t.Fatalf("adaptive bulk soft payload = %d, want %d", got, want)
+	}
+}
+
 func TestControlBatchSenderRespectsWriteDeadlineWhenReceiverStalls(t *testing.T) {
 	left, right := net.Pipe()
 	defer left.Close()
@@ -255,6 +292,10 @@ func (c *vectoredShortWriteConn) WriteBuffers(bufs *net.Buffers) (int64, error)
 	return written, nil
 }
 
+func (c *vectoredShortWriteConn) writeBuffers(bufs *net.Buffers) (int64, error) {
+	return c.WriteBuffers(bufs)
+}
+
 type unwrapVectoredConn struct {
 	inner net.Conn
 }