fix: respect transport protocol during hot reload

[dr-hoseyn]

Summary

• probe the tunnel listener with its actual transport protocol during hot reload
• use UDP checks for UDP, KCP, and QUIC instead of incorrectly probing TCP
• skip unsafe availability probes for raw-socket XDI/SPOOF transports
• give the tunnel and web listeners independent settling timeouts

Why

The previous reload path always used net.Listen(tcp, ...). For UDP-based transports this could report the port as available while the old UDP socket was still bound, causing the restarted tunnel to race and fail.

Verification

• GOOS=linux GOARCH=amd64 go vet ./cmd
• GOOS=linux GOARCH=amd64 go test -c ./cmd
• added TCP/UDP/raw transport classification coverage and a UDP release/wait test