perf: reuse immutable TLS profile snapshots

[jtenner]

Stack status

• stacked on draft PR feat: complete bounded TLS client/server streams #3 / branch agent/tls-full-grid
• head: 4c844be
• base head: eddbfa6
• this pull request should remain a draft while its base is unmerged and hosted CI is reviewed
• hosted run 30186510604 passed every required check for head 4c844be on July 26, 2026

Summary

Removes redundant per-stream deep copies of TLS profile state while preserving the existing immutable profile boundary and fail-closed validation.

• public profile construction and lneto adapter instantiation still deep-clone caller-owned configuration, trust pools, certificate DER, OCSP/SCT metadata, ALPN, name authority, and client CAs
• client streams borrow the adapter-owned immutable profile and create only crypto/tls.Config's shallow per-connection shell needed to set the authorized ServerName
• accepted server streams share the immutable adapter-owned static server configuration instead of recopying certificate chains, OCSP/SCT data, ticket state, and client CA pools
• every stream still validates the internal profile shape before dereferencing it; a deliberately corrupted adapter profile continues to fail closed and release its private TCP port/quota rather than panicking
• session caches remain per-Wago-instance and shared only by streams from the same instantiated client profile
• profile rotation, accepted-stream snapshot behavior, signer restrictions, frozen validation time, and TinyGo TLS exclusion are unchanged
• normal close and shared-namespace worker teardown now zero and drop plaintext/ciphertext rings, scratch slices, channel binding, metadata, crypto/tls.Conn, transport, and profile references immediately after workers join, so stale closed wrappers cannot pin large buffers or certificate/CA graphs

Correctness and race evidence

• adds client/server assertions that stream state borrows the already validated adapter profile snapshot
• adds four concurrent TLS 1.3 server handshakes sharing one immutable profile
• retains the corrupted-profile setup-failure regression in the lneto TLS adapter
• all 17 TLS signoff package profiles pass, resolving 170 named test targets
• explicit retained-state assertions cover both normal close and worker-only namespace teardown
• focused ordinary and race suites pass for the standard-Go engine, lneto TLS adapter, aggregate lneto backend, and public TLS registration

Allocation and performance evidence

Controlled linux/amd64 Go 1.24.4 benchmarks:

• TLS 1.3 client handshake: approximately 391,650 B/op, 964 allocations before; 390,050 B/op, 952 allocations after
• TLS 1.3 server handshake: approximately 391,220 B/op, 954 allocations before; 389,650 B/op, 948 allocations after
• server stream construction with 96 KiB of immutable OCSP/SCT metadata: approximately 382 KiB/op, 45 allocations, 40–44 µs before; 282 KiB/op, 37 allocations, 30–35 µs after
• the savings scale with configured certificate-chain, OCSP/SCT, client-CA, and authority-map size because those immutable objects are no longer recopied for every connection

The complete benchmark smoke matrix discovers and passes 174 top-level targets in 50 packages, expanding to 204 result names.

Validation

• go test -shuffle=on -count=1 ./...
• focused race suites
• go vet ./...
• source-boundary and diff checks
• scripts/tls-signoff.sh
• one-iteration complete scripts/benchmark-smoke.sh matrix
• full repository tests after the close-time memory release change
• hosted test/shuffle/vet/source-boundary, race, TLS signoff, checkptr/386, and all 123 TinyGo-supported packages; the TinyGo matrix completed in 40m53s

Explicitly unchanged

No guest ABI, capability, cryptographic primitive, TLS version default, session-resumption authority, listener authority, TinyGo support claim, or release-adoption claim changes in this pull request.