feat(ipc): negotiate worker frame max, add gRPC headroom, bound DrainEvents (IPC-02/03/04 gateway half)

Proto foundation + gateway-side of the size/backpressure pass:

- IPC-02: add GatewayHello.max_frame_bytes (regen Generated/); gateway sends
  its negotiated worker-frame max in the handshake so the worker can adopt it
  instead of a hard-coded default. Worker read-half lands separately.
- IPC-03: give the pipe frame max envelope-overhead headroom above the public
  gRPC cap (WorkerFrameProtocolOptions.EnvelopeOverheadReserveBytes = 64 KiB;
  default Worker.MaxMessageBytes bumped to 16 MiB + reserve), cross-validate the
  headroom at startup, and pre-check command envelope size in WorkerClient so an
  oversized command fails only that correlation (ResourceExhausted) instead of
  faulting the whole session.
- IPC-04: reject DrainEvents max_events above a public ceiling in the request
  validator (worker per-reply cap lands with the worker half).

Docs: GatewayConfiguration, WorkerFrameProtocol, gateway.md.
Tests: headroom validation, DrainEvents bound, oversized-command per-command
failure (pipe-harness, verified on windev).

src/ZB.MOM.WW.MxGateway.Tests/Configuration/GatewayOptionsValidatorTests.cs

@@ -771,4 +771,50 @@ public sealed class GatewayOptionsValidatorTests
         Assert.True(result.Failed);
         Assert.Contains(result.Failures!, f => f.Contains("ApiKeyFailureTrackedPeers"));
     }
+
+    private static GatewayOptions WithWorkerAndProtocol(WorkerOptions worker, ProtocolOptions protocol)
+    {
+        GatewayOptions source = ValidOptions();
+        return new GatewayOptions
+        {
+            Authentication = source.Authentication,
+            Ldap = source.Ldap,
+            Worker = worker,
+            Sessions = source.Sessions,
+            Events = source.Events,
+            Dashboard = source.Dashboard,
+            Protocol = protocol,
+            Alarms = source.Alarms,
+            Tls = source.Tls,
+        };
+    }
+
+    /// <summary>
+    /// Verifies the default worker-frame maximum keeps the required envelope-overhead reserve above
+    /// the default public gRPC cap, so a stock configuration passes the IPC-03 headroom check.
+    /// </summary>
+    [Fact]
+    public void Validate_Succeeds_WhenWorkerFrameMaxHasEnvelopeHeadroom()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(null, ValidOptions());
+        Assert.True(result.Succeeded);
+    }
+
+    /// <summary>
+    /// Verifies that a worker-frame maximum equal to the gRPC cap (zero headroom) fails validation:
+    /// a maximally-sized accepted gRPC payload would not fit one worker frame once wrapped in a
+    /// WorkerEnvelope, faulting the whole session on the outbound write (IPC-03).
+    /// </summary>
+    [Fact]
+    public void Validate_Fails_WhenWorkerFrameMaxEqualsGrpcMaxWithoutHeadroom()
+    {
+        const int grpcMax = 16 * 1024 * 1024;
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithWorkerAndProtocol(
+                new WorkerOptions { MaxMessageBytes = grpcMax },
+                new ProtocolOptions { MaxGrpcMessageBytes = grpcMax }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("MaxMessageBytes") && f.Contains("reserve"));
+    }
 }