feat(mesh): deployment_artifact.v1 proto + first in-repo Grpc.Tools codegen

The repo has consumed packaged gRPC clients (LocalDb.Replication,
HistorianGateway.Client) but never compiled a proto locally. This adds the
Grpc.Tools toolchain to Commons and a deployment_artifact.proto with a single
server-streaming Fetch(deployment_id) -> stream ArtifactChunk RPC, generating
both the server base and the client stub (GrpcServices="Both") so central
(Host/AdminUI) and the node (Runtime) share one reference. A compile-touch test
pins the codegen: it stops compiling if generation regresses.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Protos/deployment_artifact.proto

@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package deployment_artifact.v1;
+
+option csharp_namespace = "ZB.MOM.WW.OtOpcUa.Commons.Protos.DeploymentArtifact.V1";
+
+// Central serves the deployed-configuration artifact bytes to a driver node (per-cluster mesh
+// Phase 3). Only admin-role nodes — which hold the central SQL connection — serve; driver nodes in
+// FetchAndCache mode are the clients. The bytes travel here, out-of-band, precisely so they never
+// ride an Akka message and hit the frame-size limit.
+service DeploymentArtifactService {
+  // Streams the artifact for a sealed deployment as ordered chunks. NotFound when the id is
+  // unknown, the deployment is not sealed, or the blob is empty (existence-hiding + the #485
+  // "empty bytes are never an empty config" rule). The client verifies
+  // SHA-256(reassembled) == the RevisionHash it already holds from DispatchDeployment, so no hash
+  // is carried here.
+  rpc Fetch(FetchRequest) returns (stream ArtifactChunk);
+}
+
+message FetchRequest {
+  string deployment_id = 1;
+}
+
+message ArtifactChunk {
+  bytes data = 1;
+}