Complete native UDP M1 foundation

[ssharkkky]

Summary

• add a dormant Chromium-backed CONNECT-UDP tunnel seam without changing the existing TCP ingress path
• reuse QuicProxyDatagramClientSocket for RFC 9298 CONNECT-UDP and HTTP/3 DATAGRAM, including cached Basic proxy authentication
• add controlled QUICHE interoperability binaries and G1/G2/G3/G5 end-to-end fixtures
• document the native UDP plan, M1 completion state, and independent agy audit

Why

M1 is the architecture decision gate for native UDP. This change proves that NaiveProxy can acquire a Chromium QUIC proxy stream and carry real UDP datagrams over standard CONNECT-UDP before the SOCKS5 UDP ingress and production association lifecycle are introduced in M2.

Impact

• no user-visible SOCKS5 UDP support is enabled yet
• the existing TCP data path remains unchanged
• changes are limited to the reusable Chromium datagram seam, dormant Naive integration code, controlled test tools, tests, and project documentation

Validation

• built naive, naive_masque_server, naive_masque_client, naive_masque_probe, and naive_connect_udp_runner
• G1 controlled MASQUE smoke: G1_MASQUE_SMOKE_OK
• G2 real Naive CONNECT-UDP tunnel, including IPv6 authority/target: G2_NAIVE_TUNNEL_OK
• G3 Basic proxy authentication: G3_BASIC_AUTH_OK
• G5 lifecycle and structured NetLog checks: G5_LIFECYCLE_OK
• all 56 existing TCP test cases
• git diff --check and shell syntax checks
• independent agy review: AUDIT_PASS