Automatic tunnel transport selection

The rstream Go CLI and SDK now select their tunnel transport automatically, preferring QUIC while keeping TLS available when the UDP path cannot be established.

QUIC is a better default for many tunnel workloads, but it is not reachable from every network. Firewalls, VPNs, and public Wi-Fi can block or degrade UDP while allowing TCP on the same endpoint. Automatic selection lets clients use QUIC where it works without turning those network differences into a configuration requirement for every deployment.

Selection happens when a client opens its control channel. QUIC receives a brief head start, TLS starts if QUIC has not connected, and the first successful transport is kept for the lifetime of that client. Tunnels and streams created through the control channel use the same choice. Authentication and protocol failures do not trigger a second connection over another transport once one path has been selected.

auto is now the default transport mode and can also be selected explicitly in YAML, with RSTREAM_TUNNEL_TRANSPORT=auto, or with --tunnel-transport auto. The Go CLI and SDK implement QUIC and TLS selection. The JavaScript, Python, Java, and C++ SDKs accept the same shared configuration but currently resolve auto to TLS; an explicit quic request fails instead of being silently downgraded. rstream doctor probes both paths independently and reports whether automatic selection will prefer QUIC or fall back to TLS.

Automatic selection is available in rstream CLI and Go SDK 1.24.0, @rstreamlabs/runtime 0.5.0, rstream Python SDK 0.3.0, rstream Java SDK 0.2.0, and rstream C++ SDK 1.12.0.

See Tunnel Transports, Configuration File, and Troubleshooting for configuration, proxy behavior, and transport diagnostics.