Smoke test mixed VPN fabric batches

agents/rap-node-agent/cmd/mesh-live-smoke/main.go

@@ -272,10 +272,7 @@ func smokeFabricVPNPacketOverSession(ctx context.Context, fabricSession *mesh.Fa
 	}
 	bulkPacket := smokeIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51000, 443, 0)
 	controlPacket := smokeIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51001, 3389, 0x02)
-	if err := transport.SendGatewayPacketBatch(ctx, [][]byte{bulkPacket}); err != nil {
-		return false, false, err
-	}
-	if err := transport.SendGatewayPacketBatch(ctx, [][]byte{controlPacket}); err != nil {
+	if err := transport.SendGatewayPacketBatch(ctx, [][]byte{bulkPacket, controlPacket}); err != nil {
 		return false, false, err
 	}
 	timer := time.NewTimer(3 * time.Second)

docs/architecture/DISTRIBUTED_FABRIC_NODE_PROTOCOL_PLAN.md

@@ -402,6 +402,8 @@ counters for verifying that stream shard cleanup is actually happening.
 Outgoing VPN packet batches are split by traffic class and selected stream
 before they are framed, so one gateway batch containing many browser flows does
 not collapse onto the first packet's logical stream.
+`mesh-live-smoke` now sends mixed bulk and interactive VPN packets in a single
+fabric-session batch and requires them to remain sharded.
 Endpoint ranking treats `capacity_limited` observations as a soft pressure
 penalty instead of a hard recent failure, enabling load spreading without
 marking the carrier unhealthy.