perf: batch outbound writes with whole-buffer encryption and atomic bundles

[carabistouflette]

Type of change

• Block implementation
• Item implementation
• Command implementation
• Entity implementation
• Bug fix
• New feature
• Breaking change
• Refactor / code cleanup
• Performance improvement

Description

Overhauls the Java outbound write path. It also adds the criterion benchmarks used for the
measurements below (steel-protocol/benches/packet_codec.rs: whole-buffer encryption
throughput, and per-packet-flush vs batched-single-flush socket write patterns), kept in-tree
for future regression tracking:

• StreamEncryptor encrypts whole buffers at once (mirroring vanilla CipherBase.encipher) instead of running one async poll_write per byte, and retains partially written encrypted bytes across polls so a partial socket write can never desync the CFB8 stream.
• New OutboundPacket::Bundle variant: bundle delimiters and sub-packets are queued as a single channel message, eliminating the multi-producer interleaving race where another packet could land between a bundle's delimiters.
• TCPNetworkEncoder::write_packets writes a batch of packets with a single flush; both sender tasks (pre-play and play) drain up to 128 queued packets per writer-lock acquisition via recv_many.
• A batch write that fails partway drops the encoder instead of returning it to the shared writer slot: mid-packet CFB8 cipher state must never be reused. write_outbound_batch/OUTBOUND_BATCH_SIZE are shared between the play and pre-play sender loops in player::connection.

How this was tested

• cargo test -p steel-core --lib connection::java (16 tests, incl. new send_encoded_bundle_sends_one_atomic_bundle_message), cargo test -p steel-core --lib player::connection (adds failed_batch_write_discards_the_encoder and successful_batch_write_restores_the_encoder for the poison-on-failure behavior), cargo test -p steel-protocol --lib (new encrypts_whole_buffers_like_vanilla_cipher and retains_unwritten_encrypted_bytes_across_partial_writes), cargo test -p steel-login, cargo clippy -r --all-targets clean.
• Benchmarks: numbers and replication steps in Measurements below.

Measurements

Run back-to-back on the same idle machine (Linux x86_64 laptop, Intel Core Ultra 7 258V, Rust
nightly, criterion defaults: 3 s warmup, 5 s measurement, 100 samples; loopback TCP with
TCP_NODELAY and a concurrent drain task). Absolute numbers are machine-specific; the ratios
are what matter.

Outbound write pattern, 128 encrypted CKeepAlive packets per batch over loopback:

sender write path	encryptor	mean time / batch	throughput
master (36156e9): write + flush per packet	byte-at-a-time	238.6 µs	0.54 Melem/s
this PR: write + flush per packet	whole-buffer	223.1 µs	0.57 Melem/s
this PR: batched, single flush	whole-buffer	27.9 µs	4.59 Melem/s

Batching alone gives ~8.6x more outbound throughput per writer-lock acquisition vs the
master send path — one write syscall per batch instead of one per packet. The encryptor
change contributes ~0: the per-packet rows show it is within noise of master.

Whole-buffer CFB8 encryption throughput into a non-backpressuring sink (isolates the encryptor
from the socket):

buffer size	master byte-at-a-time	this PR whole-buffer
64 B	44.8 MiB/s	45.0 MiB/s
512 B	45.6 MiB/s	47.8 MiB/s
4096 B	48.1 MiB/s	47.4 MiB/s
64 KiB	48.1 MiB/s	48.0 MiB/s

Throughput parity (AES dominates; ≤ run-to-run noise). The encryption win is elsewhere: one
task reschedule per buffer instead of per byte when the socket backpressures, and no dropped
bytes when the inner writer returns Ok(0).

How to replicate

On this branch (all three arms above except the master row):

cargo bench -p steel-protocol --bench packet_codec

For the master baseline row, run the same bench against the commit this PR branches from.
The bench needs write_packets, which only exists on this branch, so copy it onto a master
worktree and drop the batched arm:

git worktree add --detach /tmp/steel-master 36156e984
mkdir -p /tmp/steel-master/steel-protocol/benches
git show pr1-batched-outbound-writes:steel-protocol/benches/packet_codec.rs \
  > /tmp/steel-master/steel-protocol/benches/packet_codec.rs
cat >> /tmp/steel-master/steel-protocol/Cargo.toml <<'EOF'

[dev-dependencies]
criterion = { workspace = true, features = ["async_tokio"] }

[[bench]]
name = "packet_codec"
harness = false
EOF
# delete the `group.bench_function("batched_single_flush", ..)` block from
# /tmp/steel-master/steel-protocol/benches/packet_codec.rs (`write_packets` does not exist on master)
cd /tmp/steel-master && cargo bench -p steel-protocol --bench packet_codec

Screenshots / logs

N/A (no visual surface).

Checklist

• Code builds w/o errors or warnings
• Self-reviewed the diff
• Docs updated (if applicable) — N/A, no docs cover this area yet
• No leftover debug code / comments

Additional notes

• Stack: pr2-outbound-byte-budget is stacked on this branch.
• Env: Linux, Rust nightly, Minecraft protocol 776 (0.15.2+mc26.2).

[coco875]

I would like an confirmation that it don't do something similar to with #473

[github-actions]

This pull request has conflicts with the base branch "master". Please resolve those so we can test out your changes.