Keep experimental native TCP outside stable defaults

[RobLe3]

Summary

• require explicit provider/runtime opt-in before mounting or advertising native TCP
• stop deriving native transport advertisement from the HTTP endpoint
• default NAT detection to no native transport port
• preserve normalized explicit opt-in in generated launchd/systemd services
• document plaintext native TCP as development-only and outside the stable/production baseline

Validation

• full local quality matrix on Rust 1.86 and stable
• locked tests and clippy passed
• Docker instance-lock, RustSec, coverage, package and clean-install gates passed
• coverage 68.365% (minimum 64%)
• Sentrux check passed; the gate's complex-function drift is reproduced unchanged on exact origin/main

No release or deployment is part of this PR.