Add managed Naive HTTP2 reverse TCP with verified helpers and recovery

[dr-hoseyn]

Plain reverse TCP can be unavailable on a filtered route. This adds an optional managed Naive HTTP/2 carrier around the existing TCP reverse engine, with official NaiveProxy on the outside client and a restricted sing-box inbound on Iran. The helper cannot reach other destinations, including through an IPv4-mapped loopback CIDR; pairing, forwarding, tokens, pool management and metrics remain owned by BackPack.

The tunnel owns helper startup, private configuration, crash restart and process-group cleanup. Nil output streams prevent inherited child pipes from hiding leader exit; preflight descendants are also killed. Ordinary edits preserve private helper settings, the generated TLS material is frozen so sing-box cannot install a rejected certificate independently, and valid certificate/key or CA replacement reloads the generation without a TOML edit while an incomplete pair keeps it running.

Optional BP_HELPERS=naive installation verifies pinned official NaiveProxy v154.0.8037.49-4 and sing-box v1.14.2 archives and publishes immutable version directories. BP_HELPERS=xray prepares the official pinned binary for the separate managed-Xray change. Default installation does not download helpers.

Validation at exact head b2a0612af3c86d3712460c6117ba076fdd7186f1: Linux validation passed baseline defect reproduction, lifecycle races, certificate renewal, existing config/spec/health tests, vet, installer checksums/failure cleanup, and complete reverse traffic using the official helpers. Payload/file checks were repeated after helper, engine and config-generation restarts on both sides. Supplemental fixtures/workflows stay in the fork; no new repository test file is added.

Linux amd64/arm64, reverse TCP, one endpoint and TCP forwarding only. Configure both TOML files manually; there is no website frontend or universal filtering-resistance claim. Complete directional EOF across proxy helpers is supplied by #85, including the reverse relay fix from #69; deploy matching managed-carrier builds on both ends. #66 separately supplies TCP lifecycle and recovery fixes.

[AminMGMT]

Closing: this work is on main already, carried in by #85.

codex/naive-http2-wrapper is a git ancestor of codex/managed-xhttp-reality (git merge-base --is-ancestor confirms it), so all 9 commits and all 20 files of this PR went in with 88b2900 — along with the later commits in #85 that refined the same code (Freeze Naive TLS material until validated generation renewal, Canonicalize mapped loopback CIDR in the Naive destination allowlist, and the rest).

Because #85 was squash-merged, re-merging this branch now would not be a no-op: git would three-way merge the earlier version of those files against the refined version on main and partly regress it — 18 files would change. So this is closed rather than merged, and nothing is lost.

Thanks — the credit for it is on 88b2900.

---

Generated by Claude Code