feat: vendor russh-sftp with serde_bytes perf fix

Add `crates/bssh-russh-sftp`, a temporary fork of upstream `russh-sftp`
following the same pattern as the existing `crates/bssh-russh`.

The only functional change versus upstream v2.1.1 is a
`#[serde(with = "serde_bytes")]` annotation on `protocol::Write::data`
and `protocol::Data::data`, plus a wire-compatible `serialize_bytes`
implementation in `ser.rs`. Without it, `#[derive(Deserialize)]` for
`Vec<u8>` dispatches to `deserialize_seq` and parses the SFTP payload
one byte at a time — `perf` shows ~42% of server CPU in
`VecVisitor::visit_seq` during 1 GiB uploads. The annotation routes
through the existing bulk `try_get_bytes` path in the crate's own
Deserializer, which is already implemented.

Measured impact on a CPU-bound host (Xeon Silver 4214) with an OpenSSH
client performing a 1 GiB SFTP upload:

  - upstream russh-sftp 2.1.1: 74.8 MiB/s
  - this fork:                 96.4 MiB/s  (+29%)

OpenSSH `sftp-server` on the same host measures ~101 MiB/s, so the gap
narrows from ~26% to ~5%.

Upstream russh-sftp has had no commits since its v2.1.1 bump
(2025-04-18) and two download-perf issues (#55 closed without root
cause, #70 open) sit unanswered, so the fix lives here until upstream
activity resumes. `sync-upstream.sh` and `create-patch.sh` mirror the
`bssh-russh` tooling so future syncs are mechanical.

The top-level dependency is switched from
`russh-sftp = "2.1.1"` to
`russh-sftp = { package = "bssh-russh-sftp", version = "2.1.1", path = "crates/bssh-russh-sftp" }`
so every `use russh_sftp::...` import in bssh continues to work
unchanged.

Author: Yaminyam

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Internal fork of `russh-sftp` as `crates/bssh-russh-sftp` with a `serde_bytes` performance fix for `SSH_FXP_WRITE` and `SSH_FXP_DATA` packets. The upstream serde derive routes `Vec<u8>` through `deserialize_seq` (byte-by-byte), accounting for ~42% of server CPU during 1 GiB SFTP uploads in `perf` profiling. Annotating the `data` fields with `#[serde(with = "serde_bytes")]` and implementing wire-compatible `serialize_bytes` on the SFTP `Serializer` routes through the existing bulk `deserialize_byte_buf`/`try_get_bytes` path. Measured impact on a CPU-bound host (Xeon Silver 4214): 1 GiB SFTP upload throughput improves from 74.8 MiB/s to 96.4 MiB/s (+29%), closing the gap to OpenSSH `sftp-server` from ~26% to ~5%.
+
+### Changed
+- Switched the top-level `russh-sftp` dependency from crates.io `russh-sftp = "2.1.1"` to `russh-sftp = { package = "bssh-russh-sftp", version = "2.1.1", path = "crates/bssh-russh-sftp" }`. All existing `use russh_sftp::...` imports continue to work unchanged.
+
 ## [2.1.2] - 2026-04-27
 
 ### Fixed

Cargo.lock

@@ -2,6 +2,7 @@
 members = [
     ".",
     "crates/bssh-russh",
+    "crates/bssh-russh-sftp",
 ]
 
 [package]
@@ -23,7 +24,8 @@ tokio = { version = "1.52.1", features = ["full"] }
 # - Development: uses local path (crates/bssh-russh)
 # - Publishing: uses crates.io version (path ignored)
 russh = { package = "bssh-russh", version = "0.60.1", path = "crates/bssh-russh" }
-russh-sftp = "2.1.1"
+# Use our internal russh-sftp fork with a serde_bytes perf fix
+russh-sftp = { package = "bssh-russh-sftp", version = "2.1.1", path = "crates/bssh-russh-sftp" }
 clap = { version = "4.6.1", features = ["derive", "env"] }
 anyhow = "1.0.102"
 thiserror = "2.0.18"

Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "bssh-russh-sftp"
+version = "2.1.1"
+authors = ["Jeongkyu Shin <inureyes@gmail.com>"]
+description = "Temporary fork of russh-sftp with a serde_bytes performance fix for SFTP Write/Data packets"
+documentation = "https://docs.rs/bssh-russh-sftp"
+edition = "2021"
+homepage = "https://github.com/lablup/bssh"
+keywords = ["russh", "sftp", "ssh2", "server", "client"]
+license = "Apache-2.0"
+readme = "README.md"
+repository = "https://github.com/lablup/bssh"
+
+[dependencies]
+tokio = { version = "1", default-features = false, features = [
+    "io-util",
+    "rt",
+    "sync",
+    "time",
+    "macros",
+] }
+tokio-util = "0.7"
+serde = { version = "1.0", features = ["derive"] }
+serde_bytes = "0.11"
+bitflags = { version = "2.9", features = ["serde"] }
+async-trait = { version = "0.1", optional = true }
+
+thiserror = "2.0"
+chrono = "0.4"
+bytes = "1.10"
+log = "0.4"
+flurry = "0.5"
+
+[features]
+async-trait = ["dep:async-trait"]