feat(runtime-host): add experimental direct peer transport

[M4n5ter]

English

Summary

Add the Milestone 1 experimental direct-peer transport from #3842:

• run rust-libp2p behind a small napi-rs boundary
• adapt verified direct streams to the existing Runtime Host framing, handshake, credential, listener, reconnect, and shutdown contracts
• pin profiles to the expected PeerId and Root ID while keeping route hints mutable
• allow relay coordination for DCUtR, but never admit Runtime Host application traffic over a relayed connection
• expose operator-only CLI configuration; managed distribution and Desktop onboarding remain follow-up work

Refs #3842

Verification

• cargo fmt --check and cargo clippy --locked --all-targets -- -D warnings
• native addon build and real Node endpoint startup on macOS and Linux
• three-platform native admission workflow for macOS, Linux, and Windows
• npm run lint, npm run format:check, npm run build, and npm run typecheck
• affected Runtime Host framing, profile, listener/kernel, and CLI suites
• macOS-to-Linux direct native stream over LAN
• controlled full-cone NAT harness with the Host and Client on separate private networks behind independent NATs: the reference probe and a real authenticated Runtime Host host.status request both completed over a direct path after the coordination circuit closed
• ASF source/header checks and required Knip checks

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under the contributor's direction. Final human review remains required.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

实现 #3842 Milestone 1 的实验性 direct-peer transport：

• 在精简的 napi-rs 边界后运行 rust-libp2p
• 将已验证的 direct stream 适配到现有 Runtime Host framing、handshake、credential、listener、reconnect 与 shutdown 契约
• profile 固定预期 PeerId 与 Root ID，同时允许 route hints 更新
• 允许 Relay 协助 DCUtR 协调，但绝不允许 Runtime Host application traffic 经 relayed connection 进入
• 本 PR 只提供 operator CLI 配置；managed distribution 与 Desktop onboarding 留给后续 PR

Refs #3842

验证

• cargo fmt --check 与 cargo clippy --locked --all-targets -- -D warnings
• macOS、Linux 上构建 native addon 并真实启动 Node endpoint
• macOS、Linux、Windows 三平台 native admission workflow
• npm run lint、npm run format:check、npm run build 与 npm run typecheck
• 受影响的 Runtime Host framing、profile、listener/kernel 与 CLI 测试
• macOS 到 Linux 的 LAN direct native stream
• 受控 full-cone NAT harness：Host 与 Client 分处两个私网并经过独立 NAT；reference probe 与真实、带认证的 Runtime Host host.status 请求都在协调 circuit 关闭后经 direct path 完成
• ASF source/header 检查与要求的 Knip 检查

AI 使用

请且仅选择一项：

• 没有生成式工具作出实质贡献
• 生成式工具作出了实质贡献

工具与范围：Codex 在贡献者指导下实现并验证本次改动；最终仍需人工审查。

Checklist

• 测试覆盖本次变更，并会在缺少变更时失败
• lint、format、typecheck 与受影响测试已在本地通过

本 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[Astro-Han]

LGTM