[SunSi12138]

Closes #73

Summary

• add immutable NegotiatedSessionOptions and a one-shot RpcSession.TryCompleteHandshake publication boundary
• atomically publish negotiated values, flow controller, compression binding, and Ready; remove split setters and double-write paths
• centralize protocol phase/frame eligibility across handshake, send, receive, draining, stopping, and terminal paths
• add deterministic publication/failure/race/frame-matrix/live duplicate-response tests and a zero-allocation snapshot benchmark

Ubuntu bare-metal validation

• Release solution build: 0 warnings, 0 errors
• Unit: 666/666
• Integration: 275/275
• Generator: 124/124
• Load: 8/8
• Stream Load: 21/21
• dotnet format Sharplink.slnx --verify-no-changes --no-restore: passed
• package build and generated assembly dependency verifier: passed
• Protocol v2 API3/API4 cross-version matrix: all four client/server pairs passed
• Linux NativeAOT independent-process shared-memory smoke: passed
• 20-second chaos smoke: 260233 success, 59712 injected, 0 unexpected, 0 client/server errors, 0 unobserved exceptions

Long-duration soak/Nightly execution was intentionally skipped per direction.

Performance

Same Ubuntu host, BenchmarkDotNet, 8 warmups / 20 iterations / 2 launches:

• SendPumpEnqueueAndFlush base/head mean: 1.647 us / 1.621 us (head ~1.6% faster)
• allocation: 590 B / 590 B
• batched negotiated snapshot read: mean 0.2330 ns/read, P50 0.2322 ns, P99 0.24 ns, 0 B

Protocol v2 wire format and Generated API 4 are unchanged.

[SunSi12138]

CI follow-up (db62e3d): the first Release Gate exposed a deterministic final-response/shutdown race in the independent-process AOT harness. The server-side test process previously began shutdown from inside the final service method, so a constrained runner could close the transport before the client observed that method's response.

The harness now uses an out-of-band completion marker created only after the client process has validated all responses and exited. The server then stops and verifies its own clean terminal state. The rebuilt Linux NativeAOT binary passed 200 focused independent-process rounds; no production retry or delay was added.