[baijupn]

Summary

Require verified TLS for remote lemctl lucius diagnostic connections while
preserving plaintext access to the standalone daemon through literal loopback
IPs.

• Share transport policy across info, sai, and SAI completion.
• Reject enabled --tls_skip_verify with a migration message and add
  --tls_ca_cert for private CA bundles without disabling certificate checks.
• Restrict --insecure to literal loopback IPs and numeric ports, connecting
  directly without resolver or proxy routing.
• Add command and transport regression tests, Bazel targets, and a short
  documentation update.

The standalone daemon and C++ SAI client are unchanged. This change concerns the
separately built diagnostic CLI and does not assume it is packaged in downstream
images.

Verification

Validated locally on base commit
194a7d5827d97ec637c541d46684ac206284af6f:

Check	Result
go test -race -count=1 -timeout=3m -v ./dataplane/luciusctl/...	Passed; 140 focused cases
go build ./cmd/lemctl	Passed
go vet ./dataplane/luciusctl/... ./cmd/lemctl/...	Passed
Configured golangci-lint and formatting checks on affected packages	Passed
bazel build //...	Passed
make coverage	51 of 51 test targets passed
make test-race	11 of 11 selected test targets passed
Final uncached affected Bazel targets	3 of 3 passed

Focused Bazel command:

bazel test \
  //dataplane/luciusctl:luciusctl_test \
  //dataplane/luciusctl/internal/transport:transport_test \
  //dataplane/luciusctl/sai:sai_test \
  --test_output=errors --cache_test_results=no

Coverage includes trusted TLS, rejected invalid certificates and legacy options,
local plaintext operation, address boundaries, proxy avoidance, and SAI
completion. The focused Go suite explicitly uses the race detector because the
repository-wide race target excludes dataplane packages.

Disposable-server checks against the actual built CLI also passed for loopback
and isolated non-loopback targets. Baseline rejection tests failed before the
change and passed afterward. An intermediate test-source error was corrected;
the final source passed the checks above. Hosted CI results remain pending.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[sonikajindal]

@hardikharti can you pls check this PR?

[hardikharti]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Please fix this before we can review the changes thoroughly.

[baijupn]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).
View this failed invocation of the CLA check for more information.
For the most up to date status, view the checks section at the bottom of the pull request.

Please fix this before we can review the changes thoroughly.

I have requested CLA with baijup@microsoft.com with Individual CLA. Please let me know if this may be checked and approved ..

Thanks