wfb-link v0.1.0-alpha.4

This alpha adds the combined managed stream plus tunnel backend path requested
in issue #4.

Highlights

• Added ManagedWfbTunnelConfig.
• Added ManagedWfbStreamsConfig::with_tunnel(...).
• ManagedWfbStreamsBackend can now supervise named raw application streams
  and one IP tunnel in the same radio runtime session.
• The combined backend starts the extra tunnel wfb_tx, wfb_rx, and
  wfb-tun-macos helper processes alongside the existing per-stream helpers.
• LinkReady.endpoints.tunnel is populated when a managed tunnel is present.
• Managed-stream backend reports now include a tunnel section with the tunnel
  radio ports, product UDP sockets, internal radio UDP sockets, tunnel profile,
  summary file path, and parsed wfb-tun-macos summary when available.
• Tunnel helper criticality follows the stream model: required tunnel helper
  failures fail startup/readiness, while best-effort tunnel failures report the
  __tunnel sentinel in degraded_streams.
• The managed-streams example supports ENABLE_TUNNEL=1 for combined
  stream+tunnel launches.
• Updated README and product integration docs to describe the combined backend.

Validation

• cargo fmt --all -- --check
• cargo check --workspace --locked
• cargo build -p wfb-link --examples --locked
• cargo test --workspace --locked
• cargo test -p wfb-link --examples
• cargo test -p wfb-link
• git diff --check

Known Limitations

• A receiver-backed combined managed-stream plus tunnel bench gate still needs
  to be added and run against the Linux peer.
• RF calibration is still not full Linux parity across all conditions. Runtime
  IQK, LCK, and EFUSE TX-power profiles remain receiver-gated.
• The Linux backend remains a contract/design stub; Linux products should use
  native WFB-NG over monitor mode for now.
• Android USB host transport is planned but not implemented.
• Helper binaries, firmware, service TOML, and key material remain product
  release artifacts.