fix(tls): honor Go key exchange defaults across transports

Remove the eight explicit curve overrides so Go 1.27 honors tlsmlkem=0
across Server listeners, node links and outbound transports. Remove the
unused shared curve option and add wire-level regression coverage.

Document CA trust and TLS upgrade behavior, retain the investigation
artifacts, and exclude their synthetic routes from the rebrand guard.
The product compatibility baseline remains unchanged.

Validation: focused race tests, HTTP tests, lint, compatibility guard
positive/negative controls, and a fresh Linux build with three isolated
OIDC integration scenarios all pass.

Adversarial review: Claude Code Fable 5.1, max effort.
Final verdict: APPROVE FOR COMMIT.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/grid.go

@@ -51,9 +51,8 @@ func initGlobalGrid(ctx context.Context, eps EndpointServerPools) error {
 			grid.ContextDialer(xhttp.DialContextWithLookupHost(lookupHost, xhttp.NewInternodeDialContext(rest.DefaultTimeout, globalTCPOptions.ForWebsocket()))),
 			newCachedAuthToken(),
 			&tls.Config{
-				RootCAs:          globalRootCAs,
-				CipherSuites:     crypto.TLSCiphers(),
-				CurvePreferences: crypto.TLSCurveIDs(),
+				RootCAs:      globalRootCAs,
+				CipherSuites: crypto.TLSCiphers(),
 			}),
 		Local:        local,
 		Hosts:        hosts,
@@ -84,9 +83,8 @@ func initGlobalLockGrid(ctx context.Context, eps EndpointServerPools) error {
 			grid.ContextDialer(xhttp.DialContextWithLookupHost(lookupHost, xhttp.NewInternodeDialContext(rest.DefaultTimeout, globalTCPOptions.ForWebsocket()))),
 			newCachedAuthToken(),
 			&tls.Config{
-				RootCAs:          globalRootCAs,
-				CipherSuites:     crypto.TLSCiphers(),
-				CurvePreferences: crypto.TLSCurveIDs(),
+				RootCAs:      globalRootCAs,
+				CipherSuites: crypto.TLSCiphers(),
 			}, grid.RouteLockPath),
 		Local:        local,
 		Hosts:        hosts,