fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests
  (semantic, protoc-free) so a missing contract symbol fails the build.
- IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized
  so it is protoc-version tolerant.
- IPC-19: document + guard the "Generated/ must be committed for net48" rule
  (docs/Contracts.md, csproj comment, check-codegen.ps1).
- IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned
  grpcio/protobuf/java version asserts) so regeneration is reproducible.
- TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the
  build, tests, client checks, and the codegen guards.
- Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift.

archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated,
not yet run on a Gitea runner). Verified on macOS: NonWindows build clean,
ClientProtoInputTests 5/5, -Check exit 0.

clients/go/generate-proto.ps1

@@ -5,25 +5,46 @@ $repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..\..')
 $protoRoot = Join-Path $repoRoot 'src\ZB.MOM.WW.MxGateway.Contracts\Protos'
 $outputRoot = Join-Path $PSScriptRoot 'internal\generated'
 $modulePath = 'gitea.dohertylan.com/dohertj2/mxaccessgw/clients/go/internal/generated'
-$protoc = 'C:\Users\dohertj2\AppData\Local\Microsoft\WinGet\Packages\Google.Protobuf_Microsoft.Winget.Source_8wekyb3d8bbwe\bin\protoc.exe'
-$goPluginPath = 'C:\Users\dohertj2\go\bin'
 
-if (-not (Test-Path $protoc)) {
-    throw "protoc was not found at $protoc. See docs/ToolchainLinks.md."
-}
+function Resolve-Tool {
+    # Resolve a codegen tool from PATH first (portable), then the documented Windows fallbacks,
+    # instead of the previous hard-coded per-machine paths. See docs/ToolchainLinks.md.
+    param(
+        [string[]]$Names,
+        [string[]]$FallbackPaths
+    )
 
-foreach ($pluginName in @('protoc-gen-go.exe', 'protoc-gen-go-grpc.exe')) {
-    $pluginPath = Join-Path $goPluginPath $pluginName
-    if (-not (Test-Path $pluginPath)) {
-        throw "$pluginName was not found at $pluginPath. See docs/ToolchainLinks.md."
+    foreach ($name in $Names) {
+        $cmd = Get-Command $name -ErrorAction SilentlyContinue
+        if ($null -ne $cmd) {
+            return $cmd.Source
+        }
     }
+
+    foreach ($fallback in $FallbackPaths) {
+        if ($fallback -and (Test-Path $fallback)) {
+            return $fallback
+        }
+    }
+
+    throw "Could not find $($Names -join '/') on PATH. See docs/ToolchainLinks.md."
 }
 
+$wingetProtoc = if ($env:LOCALAPPDATA) {
+    Join-Path $env:LOCALAPPDATA 'Microsoft\WinGet\Packages\Google.Protobuf_Microsoft.Winget.Source_8wekyb3d8bbwe\bin\protoc.exe'
+} else { $null }
+$goBin = if ($env:USERPROFILE) { Join-Path $env:USERPROFILE 'go\bin' } elseif ($env:HOME) { Join-Path $env:HOME 'go/bin' } else { $null }
+
+$protoc = Resolve-Tool -Names @('protoc', 'protoc.exe') -FallbackPaths @($wingetProtoc)
+$protocGenGo = Resolve-Tool -Names @('protoc-gen-go', 'protoc-gen-go.exe') -FallbackPaths @((if ($goBin) { Join-Path $goBin 'protoc-gen-go.exe' }), (if ($goBin) { Join-Path $goBin 'protoc-gen-go' }))
+$protocGenGoGrpc = Resolve-Tool -Names @('protoc-gen-go-grpc', 'protoc-gen-go-grpc.exe') -FallbackPaths @((if ($goBin) { Join-Path $goBin 'protoc-gen-go-grpc.exe' }), (if ($goBin) { Join-Path $goBin 'protoc-gen-go-grpc' }))
+
+# protoc discovers the plugins on PATH; prepend the directories the resolved plugins live in.
+$env:Path = (Split-Path $protocGenGo -Parent) + [System.IO.Path]::PathSeparator + (Split-Path $protocGenGoGrpc -Parent) + [System.IO.Path]::PathSeparator + $env:Path
+
 New-Item -ItemType Directory -Path $outputRoot -Force | Out-Null
 Get-ChildItem -Path $outputRoot -Filter '*.pb.go' -File | Remove-Item
 
-$env:Path = "$goPluginPath;$env:Path"
-
 & $protoc `
     --proto_path=$protoRoot `
     --go_out=$outputRoot `
@@ -35,6 +56,10 @@ $env:Path = "$goPluginPath;$env:Path"
     mxaccess_worker.proto `
     galaxy_repository.proto
 
+if ($LASTEXITCODE -ne 0) {
+    throw "protoc (go) failed with exit code $LASTEXITCODE."
+}
+
 & $protoc `
     --proto_path=$protoRoot `
     --go-grpc_out=$outputRoot `
@@ -44,3 +69,6 @@ $env:Path = "$goPluginPath;$env:Path"
     mxaccess_gateway.proto `
     galaxy_repository.proto
 
+if ($LASTEXITCODE -ne 0) {
+    throw "protoc (go-grpc) failed with exit code $LASTEXITCODE."
+}