docs(TST-27,WRK-26,CLI-42,CLI-43,IPC-28): P1 doc-drift batch, discharges IPC-29

TST-27: docs/GatewayConfiguration.md's ShowTagValues row no longer says
"Reserved" — it now states what false (default) does (DashboardEventBroadcaster
blanks tag values from a deep-cloned MxEvent before the SignalR events-hub
mirror), the security relevance (no per-session hub ACL yet, so this
redaction is the only thing between a low-trust Viewer and other sessions'
tag values), and the honest scope limit (does not cover /browse).

WRK-26 (discharges IPC-29): docs/MxAccessWorkerInstanceDesign.md's "Outbound
Queues" section rewritten from the stale five-level priority list to the
two-class Control/Event scheduler actually shipped, with the collapsed-
decision rationale, and the overflow paragraph rewritten to the implemented
fail-fast. docs/WorkerFrameProtocol.md gained a "Write Scheduling And
Sequencing" section describing HEAD truthfully: WRK-23's peek-stamp-commit
sequencing is live, WRK-25's event-batch flush coalescing is not (the drain
loop still awaits each event write individually), and WRK-22's cancellation
tombstone is not yet defined (noted as pending, not documented as shipped).

CLI-42: clients/rust/README.md and docs/ClientPackaging.md document the
vendored Rust proto layout matching build.rs — repo-path-first resolution
falling back to clients/rust/protos/, the check-codegen.ps1 Check 3 refresh
rule, and why cargo package/publish run without --no-verify.

CLI-43: docs/style-guides/JavaStyleGuide.md now says Java 17 (Ignition 8.3
baseline), mirroring CLI-12's wording, matching the shipped build.gradle.

IPC-28: docs/Grpc.md's exception-mapping prose gained CommandTooLarge ->
ResourceExhausted, and the Invoke section gained the oversized-payload
sentence, cross-referencing GatewayConfiguration.md's headroom rule.

Tracking: TST-27, WRK-26, CLI-42, CLI-43, IPC-28 flipped to Done and IPC-29
marked discharged-by-WRK-26 in 00-tracking.md and the 20/30/50/60 domain
registers, with a 2026-08-07 change-log entry.

Doc-only change; no source, proto, or test edits.

clients/rust/README.md

@@ -18,9 +18,22 @@ clients/rust/
   crates/mxgw-cli/
 ```
 
-`build.rs` reads the `.proto` files from
-`../../src/ZB.MOM.WW.MxGateway.Contracts/Protos` and generates `tonic`/`prost` bindings
-into Cargo build output. `src/generated.rs` declares the Rust modules that
+`build.rs` resolves the `.proto` inputs repo-path-first: it prefers the
+canonical protos at `../../src/ZB.MOM.WW.MxGateway.Contracts/Protos` (two
+levels above `clients/rust`) so a local in-repo `.proto` edit is picked up
+live without any extra step, and falls back to the vendored copies checked
+into `clients/rust/protos/` only when that canonical directory is absent —
+the case for a consumer building the crate unpacked from a published
+tarball, where the rest of the mxaccessgw repo does not exist. The vendored
+copies are shipped in the published `.crate` via `Cargo.toml`'s `include`
+list, which is what makes the crate buildable standalone; they are build
+inputs only, never a second source of truth. **Refresh rule:** any commit
+that edits a Contracts proto (`mxaccess_gateway.proto`, `mxaccess_worker.proto`,
+`galaxy_repository.proto`) must copy the changed file(s) into
+`clients/rust/protos/` in that same commit — `scripts/check-codegen.ps1`
+Check 3 fails the build on byte drift between the vendored copies and the
+canonical Contracts protos. `tonic`/`prost` bindings are generated into
+Cargo build output. `src/generated.rs` declares the Rust modules that
 include those generated files. `src/generated` remains reserved for checked-in
 generator output if the crate later changes to source-tree generation.