Finalmask header-custom: extend expression primitives for 1:1 handshakes

[fatyzzz]

Summary

• add little-endian packing: le16, le32, le64
• add byte-shaping transforms: pad, truncate
• add simple numeric and bitwise transforms: add, sub, and, or, shl, shr

Why

At this point, this is probably my last handshake-hardening follow-up for header-custom.

After reading several RFCs and comparing a few real handshakes, I made a short list of missing primitives that still blocked some 1:1 packet shapes. This PR is that list collected into one follow-up: little-endian encoding, byte shaping, and simple numeric / bitwise transforms.

The UX is not perfect, but I think it is already clear enough for the kind of user who would actually use header-custom at this level. I am also writing documentation for it gradually.

Scope

• extend the transform surface with little-endian packing ops
• add exact byte-shaping helpers for packet layout control
• add simple nested numeric / bitwise ops for derived fields
• keep the existing header-custom model and runtime behavior unchanged outside the new ops

Non-Goals

• no new protocol-specific helpers
• no new top-level config objects

Test Plan

• go test ./infra/conf -run 'Test(HeaderCustomUDPBuild|HeaderCustomTCPBuildRejectsMixedItemKinds|HeaderCustomUDPBuildRejectsInvalidVariableNames|HeaderCustomUDPBuildRejectsExprWithoutArgs)' -count=1
• go test ./transport/internet/finalmask/header/custom -count=1
• go test -race ./transport/internet/finalmask/header/custom -count=1
• go test ./transport/internet/finalmask -run 'Test(ConnReadWrite|PacketConnReadWrite|TCPcustomStaticHandshakeRoundTrip|TCPcustomClientRejectsMismatchedServerSequence|UDPcustomStaticHeaderWireShape|UDPcustomServerRejectsMismatchedStaticHeader)' -count=1
• local live smoke on current main base:
  • TCP via SOCKS5 returned expr-smoke-ok
  • UDP via SOCKS5 UDP ASSOCIATE returned expr-udp-smoke-ok