[J1ngxuan]

When Vision starts writing directly to the underlying transport, closing the outer TLS connection can append a 24-byte encrypted close_notify record to the raw stream. This is the failure described in SagerNet/sing-box#4404.

This branch includes the current dev commit a0c5854, which already fixes the direct-write close path. Production Vision code now matches dev. The remaining changes add regression coverage and repair lint toolchain compatibility:

• Test real loopback TLS 1.3 connections before direct copy, after direct write, after direct read only, and after both directions switch.
• Exercise the actual Vision padding transitions. Direct write must close without appending TLS bytes; direct read alone must preserve the outer TLS shutdown in the still-encrypted write direction.
• Pin lint to Go 1.23.x and golangci-lint v1.64.8, and lint all packages with ./.... The previous ^1.23 selector now resolves to Go 1.27, whose export data the v1 linter cannot decode. The test workflow continues to cover the latest Go release.

Validation on Linux:

• go test -v ./... passed with Go 1.20.14, 1.21.13, 1.22.12, 1.23.12, and 1.27.3.
• go test -tags with_utls ./... -count=100 passed with Go 1.23.12.
• golangci-lint v1.64.8 run --timeout=5m ./... passed with Go 1.23.12.
• Removing the Close override makes the direct-write regression fail with the extra 24-byte TLS record.
• Closing the raw transport on direct read alone makes the read-only regression fail because close_notify is missing.

The previous Actions runs report failure but no longer expose job details. A local reproduction confirms the Go 1.27 / golangci-lint v1 export-data incompatibility; it does not establish the cause of the old test-workflow failure.