internal/pipeproxy: named pipe to engine transport

[zcsizmadia]

Toward #6 — the transport layer of the load-bearing component. HTTP-level bind-path rewriting (using the winpath package from #17) layers on top via OnAccept in a follow-up PR; keeping them separate because their tests are entirely different in character, and this half is what everything else depends on.

Deliberately HTTP-oblivious. Byte-for-byte fidelity is what makes hijacked connections (exec -it, attach) work at all, so nothing here parses a request.

• Relay — bidirectional copy with half-close propagated in both directions, so a client can send a body, half-close, then read the response. That''s the docker build / docker save shape, and the thing naive relays truncate.
• Server.Serve — concurrent connections, graceful drain, and shutdown that closes live connections instead of waiting on them.
• Listen (Windows) — go-winio pipe with an explicit SDDL: SYSTEM, administrators, interactive users. Explicit because a service running as SYSTEM would otherwise own the pipe and lock the logged-in user out. Byte mode, not message mode — message framing truncates large payloads, which is how image pulls break. TODO(#8) marks where the local Hawser Users group SID replaces IU.
• WSLDialer — one wsl.exe+socat per connection, the v0.1 design Spike A validated. Closing stdin is a genuine half-close, and Close reaps the child so a busy client can''t leave zombie wsl.exe processes behind.

A real bug surfaced while writing the real-pipe test. Serve waited for in-flight connections to finish — so any streaming client (docker logs -f, docker events) would have pinned service shutdown forever. The test hung for 5s and failed. Serve now tracks live connections and closes them on cancellation; that test is kept as TestServeShutsDownWithStreamingClient and now passes in 0.01s. Worth calling out because it would have shown up as "stopping the Hawser service hangs" long after the fact.

14 tests, 70% coverage. The Dialer seam verifies transport behavior with no WSL2 (half-close, streaming, 256 KB binary round-trip, 25 concurrent connections, dial failure), while the Windows tests drive a real named pipe through go-winio — the same transport stock docker.exe uses.

🤖 Generated with Claude Code