ci(tst-03): fix codegen-check null bug, refresh rust proto, gradle direct install

Surfaced by the first real CI run on the self-hosted runner:

- scripts/check-codegen.ps1: `git status --porcelain` returns $null on a clean
  tree, so `.Trim()` threw "cannot call a method on a null-valued expression" —
  i.e. Check 2 could never report success. Pipe through Out-String (null -> '').
- clients/rust/protos/mxaccess_worker.proto: genuinely stale — missing the
  canonical `max_frame_bytes` field. Refreshed from
  src/ZB.MOM.WW.MxGateway.Contracts/Protos (Check 3 drift guard, added in P1).
- ci.yml java job: act cannot resolve the gradle/actions monorepo action
  (`unsupported object type` on the v4 tag); install Gradle 9.5.1 directly instead
  (matches the local build) since the repo has no gradle wrapper.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

.gitea/workflows/ci.yml

@@ -101,10 +101,13 @@ jobs:
           distribution: temurin
           java-version: '17'
       # GitHub-hosted runners ship gradle on PATH; the self-hosted act image does not, and the repo
-      # has no gradle wrapper. Provision gradle (latest stable, matching the local homebrew build).
-      - uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: current
+      # has no gradle wrapper. act also can't resolve the gradle/actions monorepo action, so install
+      # gradle directly (pinned to 9.5.1, matching the local homebrew build in CLAUDE.md/memory).
+      - name: Install Gradle 9.5.1
+        run: |
+          curl -sSL "https://services.gradle.org/distributions/gradle-9.5.1-bin.zip" -o /tmp/gradle.zip
+          sudo unzip -q -d /opt/gradle /tmp/gradle.zip
+          echo "/opt/gradle/gradle-9.5.1/bin" >> "$GITHUB_PATH"
       - name: Gradle test
         working-directory: clients/java
         run: gradle test