feat(ipc): negotiate worker frame max, add gRPC headroom, bound DrainEvents (IPC-02/03/04 gateway half)

Proto foundation + gateway-side of the size/backpressure pass:

- IPC-02: add GatewayHello.max_frame_bytes (regen Generated/); gateway sends
  its negotiated worker-frame max in the handshake so the worker can adopt it
  instead of a hard-coded default. Worker read-half lands separately.
- IPC-03: give the pipe frame max envelope-overhead headroom above the public
  gRPC cap (WorkerFrameProtocolOptions.EnvelopeOverheadReserveBytes = 64 KiB;
  default Worker.MaxMessageBytes bumped to 16 MiB + reserve), cross-validate the
  headroom at startup, and pre-check command envelope size in WorkerClient so an
  oversized command fails only that correlation (ResourceExhausted) instead of
  faulting the whole session.
- IPC-04: reject DrainEvents max_events above a public ceiling in the request
  validator (worker per-reply cap lands with the worker half).

Docs: GatewayConfiguration, WorkerFrameProtocol, gateway.md.
Tests: headroom validation, DrainEvents bound, oversized-command per-command
failure (pipe-harness, verified on windev).

src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs

@@ -946,6 +946,7 @@ public sealed class MxAccessGatewayService(
             WorkerClientErrorCode.GatewayShutdown => StatusCode.Cancelled,
             WorkerClientErrorCode.InvalidState => StatusCode.FailedPrecondition,
             WorkerClientErrorCode.ProtocolViolation => StatusCode.Internal,
+            WorkerClientErrorCode.CommandTooLarge => StatusCode.ResourceExhausted,
             _ => StatusCode.Unavailable,
         };
 

src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGrpcRequestValidator.cs

@@ -5,6 +5,13 @@ namespace ZB.MOM.WW.MxGateway.Server.Grpc;
 
 public sealed class MxAccessGrpcRequestValidator
 {
+    // Upper bound on a single DrainEvents request. DrainEvents is a diagnostics RPC that returns
+    // buffered events in one non-streaming reply, so an unbounded max_events could pack the whole
+    // queue into a session-killing frame (IPC-04). The worker independently caps each reply at its
+    // own MaxDrainEventsPerReply; this public bound rejects an obviously-abusive request loudly at
+    // the boundary. max_events = 0 is allowed and means "the worker's default batch cap".
+    private const uint MaxDrainEventsPerRequest = 10_000;
+
     /// <summary>Validates an open session request.</summary>
     /// <param name="request">The request to validate.</param>
     public void ValidateOpenSession(OpenSessionRequest request)
@@ -69,6 +76,14 @@ public sealed class MxAccessGrpcRequestValidator
             throw InvalidArgument(
                 $"Command kind {command.Kind} requires payload {expectedPayload} but received {command.PayloadCase}.");
         }
+
+        // The payload case now matches the kind, so command.DrainEvents is non-null here.
+        if (command.Kind is MxCommandKind.DrainEvents && command.DrainEvents.MaxEvents > MaxDrainEventsPerRequest)
+        {
+            throw InvalidArgument(
+                $"DrainEvents max_events ({command.DrainEvents.MaxEvents}) must not exceed {MaxDrainEventsPerRequest}; "
+                + "use 0 to request the worker default batch cap.");
+        }
     }
 
     private static MxCommand.PayloadOneofCase ExpectedPayload(MxCommandKind kind)