worker: allow the stateful tunnel to run over TCP instead of QUIC

Problem

The worker's stateful tunnel to the proxy runs over QUIC. Edge proxy CPU is proportional to bytes moved, and on high-throughput workloads every byte is currently encrypted and decrypted twice: once on the worker to edge proxy leg, and again on the edge proxy to grpc-proxy leg.

On a measured high-volume workload the edge proxy achieved roughly 33 MB/s per core, reproduced across three runs at two different scales. At sustained multi-GB/s throughput that becomes the dominant cost, and horizontal scaling does not relieve it because QUIC tunnels do not migrate between proxy pods once established.

Proposal

Allow the tunnel to be carried over TCP, selected per pod by an environment variable so it can be enabled for a single function and reverted by removing the variable.

The endpoint is derived from the HTTP/3 connection config the proxy already sends, so no control plane change is needed. The connection is made in two nested steps: an authority-form CONNECT to the regional TCP entry point, which the edge proxy turns into an opaque byte pipe to the target pod, and then the ordinary POST inside that pipe. Because the edge proxy does not parse what flows inside the pipe, HTTP/1.1's rule that a response may not begin before the request body completes does not apply, which is what makes a long-lived bidirectional tunnel workable over TCP.

grpc-proxy needs no change: it receives a plain HTTP/1.1 request on a real TCP connection, so the existing hijack path works unmodified.

Failure falls through to the existing QUIC path, so enabling the variable cannot take a worker offline.

Status

Experimental and off by default. Unit tests cover the endpoint derivation. The network path has not yet been exercised end to end; that requires a matching edge proxy route and will be measured against the existing QUIC baseline before any wider use.

Start by locating the worker's stateful tunnel and the HTTP/3 connection configuration used to derive its endpoint. Verify the environment-variable selection, TCP CONNECT path, QUIC fallback, and existing endpoint-derivation unit tests; completion also requires exercising the network path with a matching edge proxy route and comparing it with the QUIC baseline.