tunnel: reduce per-frame allocations in hot path

- TAP→server: write buf[:n] directly instead of copy to new slice
- Keepalive: reuse fixed buffer instead of allocating every 3s

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pkg/client/tunnel.go

@@ -142,9 +142,7 @@ func (t *Tunnel) Bridge(tapRead func(buf []byte) (int, error), tapWrite func(buf
 				errCh <- fmt.Errorf("read from tap: %w", err)
 				return
 			}
-			frame := make([]byte, n)
+			if err := t.WriteFrames([][]byte{buf[:n]}); err != nil {
-			copy(frame, buf[:n])
-			if err := t.WriteFrames([][]byte{frame}); err != nil {
 				errCh <- fmt.Errorf("write to server: %w", err)
 				return
 			}
@@ -162,6 +160,7 @@ func (t *Tunnel) StartKeepalive() {
 		ticker := time.NewTicker(keepAliveInterval)
 		defer ticker.Stop()
 		rng := rand.New(rand.NewSource(time.Now().UnixNano()))
+		randBuf := make([]byte, maxKeepaliveSize)
 		for {
 			select {
 			case <-t.stopCh:
@@ -174,9 +173,8 @@ func (t *Tunnel) StartKeepalive() {
 				if err := binary.Write(t.sess.Conn, binary.BigEndian, size); err != nil {
 					return
 				}
-				randData := make([]byte, size)
+				rng.Read(randBuf[:size])
-				rng.Read(randData)
+				if _, err := t.sess.Conn.Write(randBuf[:size]); err != nil {
-				if _, err := t.sess.Conn.Write(randData); err != nil {
 					return
 				}
 			}