feat(ipc): negotiate worker frame max, add gRPC headroom, bound DrainEvents (IPC-02/03/04 gateway half)

Proto foundation + gateway-side of the size/backpressure pass:

- IPC-02: add GatewayHello.max_frame_bytes (regen Generated/); gateway sends
  its negotiated worker-frame max in the handshake so the worker can adopt it
  instead of a hard-coded default. Worker read-half lands separately.
- IPC-03: give the pipe frame max envelope-overhead headroom above the public
  gRPC cap (WorkerFrameProtocolOptions.EnvelopeOverheadReserveBytes = 64 KiB;
  default Worker.MaxMessageBytes bumped to 16 MiB + reserve), cross-validate the
  headroom at startup, and pre-check command envelope size in WorkerClient so an
  oversized command fails only that correlation (ResourceExhausted) instead of
  faulting the whole session.
- IPC-04: reject DrainEvents max_events above a public ceiling in the request
  validator (worker per-reply cap lands with the worker half).

Docs: GatewayConfiguration, WorkerFrameProtocol, gateway.md.
Tests: headroom validation, DrainEvents bound, oversized-command per-command
failure (pipe-harness, verified on windev).

docs/WorkerFrameProtocol.md

@@ -17,8 +17,17 @@ payload_length bytes protobuf WorkerEnvelope
 ```
 
 The reader rejects zero-length payloads and payloads larger than the configured
-maximum before allocating the payload buffer. The default maximum is 16 MiB,
-matching the gateway process design.
+maximum before allocating the payload buffer. The default maximum is the 16 MiB
+public gRPC cap plus a 64 KiB envelope-overhead reserve (16842752 bytes) so a
+maximally-sized accepted gRPC payload always fits one worker frame once wrapped
+in a `WorkerEnvelope`.
+
+The gateway is the source of truth for this maximum: it conveys the negotiated
+value in the handshake as `GatewayHello.max_frame_bytes`, and the worker adopts
+it as its `WorkerFrameProtocolOptions.MaxMessageBytes` instead of a hard-coded
+default. A `max_frame_bytes` of 0 (an older gateway that never set the field)
+means "use the worker's built-in default". This keeps both ends framing to the
+same limit rather than depending on matched compile-time constants.
 
 ## Envelope Validation