feat(ipc): negotiate worker frame max, add gRPC headroom, bound DrainEvents (IPC-02/03/04 gateway half)

Proto foundation + gateway-side of the size/backpressure pass:

- IPC-02: add GatewayHello.max_frame_bytes (regen Generated/); gateway sends
  its negotiated worker-frame max in the handshake so the worker can adopt it
  instead of a hard-coded default. Worker read-half lands separately.
- IPC-03: give the pipe frame max envelope-overhead headroom above the public
  gRPC cap (WorkerFrameProtocolOptions.EnvelopeOverheadReserveBytes = 64 KiB;
  default Worker.MaxMessageBytes bumped to 16 MiB + reserve), cross-validate the
  headroom at startup, and pre-check command envelope size in WorkerClient so an
  oversized command fails only that correlation (ResourceExhausted) instead of
  faulting the whole session.
- IPC-04: reject DrainEvents max_events above a public ceiling in the request
  validator (worker per-reply cap lands with the worker half).

Docs: GatewayConfiguration, WorkerFrameProtocol, gateway.md.
Tests: headroom validation, DrainEvents bound, oversized-command per-command
failure (pipe-harness, verified on windev).

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerFrameProtocolOptions.cs

@@ -10,6 +10,15 @@ public sealed class WorkerFrameProtocolOptions
     /// <summary>Default maximum message size in bytes (16 MB).</summary>
     public const int DefaultMaxMessageBytes = 16 * 1024 * 1024;
 
+    /// <summary>
+    /// Byte margin the worker-frame (pipe) maximum must keep above the public gRPC message cap so a
+    /// gRPC payload accepted at the public boundary always fits inside one worker frame once wrapped
+    /// in a <c>WorkerEnvelope</c> (correlation id, timestamps, oneof framing). Without this headroom
+    /// the pipe max equals the gRPC max and a maximally-sized accepted request faults the whole
+    /// session on the outbound write (IPC-03). 64 KiB is far larger than the fixed envelope overhead.
+    /// </summary>
+    public const int EnvelopeOverheadReserveBytes = 64 * 1024;
+
     /// <summary>
     /// Initializes worker frame protocol options with a session ID.
     /// </summary>