SDK: add dormant transport v2 engines

[AnthonyRonning]

Summary

Adds complete but private, dormant Transport V2 protocol engines to both in-tree SDKs:

• TypeScript and Rust canonical request/response envelope codecs
• X25519/HKDF/ChaCha20-Poly1305 handshake and direction-separated record keys
• exact session, request-ID, response-mode, and stream-sequence authentication
• one-shot prepared requests with no automatic resend path
• atomic request/response record budgets, including concurrent final-slot safety
• incremental authenticated SSE records with ordered Start/Chunk/End-or-Error finality
• byte-identical shared golden vectors against the backend implementation
• secret zeroization/redacted debug output and bounded parsing/allocation

The Rust consumer lockfiles are refreshed only to record the SDK's direct zeroize dependency.

Compatibility boundary

This PR intentionally does not select Transport V2:

• TypeScript modules are absent from the package-root exports and current consumers.
• Rust uses a private module and does not change OpenSecretClient.
• Maple, maple-proxy, and every existing /v1 request path keep their current behavior.
• Package versions are unchanged; versioning and the atomic v2-only consumer cutover belong to the next stacked PR.

Security details

• Strict duplicate-field JSON parsing and canonical base64/UUID/path handling
• Exact backend-compatible HKDF labels, AAD layouts, and record encodings
• Immutable same-session response contexts that survive parent session retirement while blocking new sends
• One random 128-bit request ID per emitted logical request
• Unary capacity and stream Start+terminal capacity reserved before request emission; chunks charge dynamically
• Authenticated pre-Start stream errors release only the provably unused terminal slot
• Fail-closed stream truncation, tampering, sequence errors, post-terminal data, and cumulative-size overflow

Validation

• TypeScript: install/audit, format, type/build, 131 passed + 3 hosted skips, 440 assertions
• TypeScript package tarball built and inspected
• Rust SDK: format, strict all-target/all-feature Clippy, 108 library tests, rustdoc warnings denied
• Rust crate packaged and verified from the packaged source
• maple-proxy: Rust 1.94 strict all-target/all-feature Clippy and rustdoc warnings denied
• Repository pre-commit gate: SDK/frontend builds, 799 frontend tests, 398 desktop-library tests + 3 binary tests (2 ignored), all passing
• In-tree SDK/proxy dependency-resolution guard passed
• Three golden-vector copies are byte-identical (dcee9930b4f129fe229f0439787ad379cd6dfc5a4a93e550b953a5a349db3375)
• Independent material-only security/compatibility review: no P0-P2 findings

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	ef82d48
Status:	✅  Deploy successful!
Preview URL:	https://f1af49dc.maple-ca8.pages.dev
Branch Preview URL:	https://codex-session-v2-maple.maple-ca8.pages.dev

View logs

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.