Build multiport lanes lazily, on data-plane demand

Lanes were established for every slot as soon as the base tunnel came up,
so a host with `routines: N` paid N-1 extra Noise handshakes, sessions and
keepalives for every peer it talked to, including peers it exchanges a
trickle with. Only routines that actually carry traffic to a peer need a
lane.

Add a per-slot demand flag to laneState. sendInsideMessage already loads
txLanes[laneSlot] on every direct-path packet; that load missing is now
the signal, and EnsureLanes only starts slots the data plane asked for.
The miss path is unchanged otherwise: the packet rides the base tunnel,
the same fallback used while a lane is down.

noteLaneDemand load-guards its store so repeated misses on a lane-less
slot are plain reads rather than a cache line ping-ponging between the
routines sharing it. The demand check is EnsureLanes' last condition, so
a slot that is pending or inside its backoff keeps the flag for the tick
that can act on it. Consuming the flag also stops a lane whose routine
went quiet from being rebuilt forever after it dies.

The wire format, lane negotiation and port-offset scheme are untouched,
so a lazy node interoperates with an eager one in both directions, and
inbound lane handshakes from a busy peer are still accepted regardless of
our own demand.

connection_manager.go

@@ -200,11 +200,13 @@ func (cm *connectionManager) doTrafficCheck(localIndex uint32, p, nb, out []byte
 	cm.ensureLanes(localIndex, decision, hostinfo)
 }
 
-// ensureLanes piggybacks lane re-establishment on the per-tunnel traffic
-// tick: any live base with lane state gets its empty slots retried (subject to
-// the per-slot backoff). makeTrafficDecision returns a nil hostinfo on some
-// keep-alive paths, so re-resolve the index in that case — an idle base must
-// still restart lanes that died while it was quiet.
+// ensureLanes piggybacks lane establishment on the per-tunnel traffic tick:
+// any live base with lane state gets the slots its data plane asked for
+// started (subject to the per-slot backoff). This tick is the right place for
+// it precisely because lanes are demand-driven — a base only lands here when
+// it has traffic, which is the same condition that raises lane demand.
+// makeTrafficDecision returns a nil hostinfo on some keep-alive paths, so
+// re-resolve the index in that case.
 func (cm *connectionManager) ensureLanes(localIndex uint32, decision trafficDecision, hostinfo *HostInfo) {
 	if decision == deleteTunnel || decision == closeTunnel {
 		return