fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests
  (semantic, protoc-free) so a missing contract symbol fails the build.
- IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized
  so it is protoc-version tolerant.
- IPC-19: document + guard the "Generated/ must be committed for net48" rule
  (docs/Contracts.md, csproj comment, check-codegen.ps1).
- IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned
  grpcio/protobuf/java version asserts) so regeneration is reproducible.
- TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the
  build, tests, client checks, and the codegen guards.
- Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift.

archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated,
not yet run on a Gitea runner). Verified on macOS: NonWindows build clean,
ClientProtoInputTests 5/5, -Check exit 0.

clients/java/zb-mom-ww-mxgateway-client/build.gradle

@@ -57,3 +57,35 @@ protobuf {
         }
     }
 }
+
+// IPC-09 guard: the generated Java tree is tracked (generatedFilesBaseDir above points at the
+// committed src/main/generated). `gradle build` regenerates it, so an un-regenerated .proto change,
+// or a plugin/protobuf version bump, silently drifts the committed output. checkGeneratedClean
+// fails when the regenerated tree differs from what is committed.
+//
+// Caveat (repo memory project_java_generated_churn): the protobuf gradle plugin also rewrites
+// MxaccessGateway.java with a spurious protobuf-runtime-version delta on every build even when no
+// .proto changed. CI reverts that one file (git checkout) before invoking this task; locally, do the
+// same when you did not touch a .proto. See docs/GatewayTesting.md "Continuous Integration".
+tasks.register('checkGeneratedClean') {
+    group = 'verification'
+    description = 'Fails if the committed generated Java tree differs from a fresh regeneration.'
+    dependsOn 'generateProto'
+    doLast {
+        def generatedDir = 'clients/java/src/main/generated'
+        def stdout = new ByteArrayOutputStream()
+        def result = exec {
+            workingDir = rootProject.projectDir.parentFile.parentFile
+            commandLine 'git', 'status', '--porcelain', '--', generatedDir
+            standardOutput = stdout
+            ignoreExitValue = true
+        }
+        def dirty = stdout.toString().trim()
+        if (!dirty.isEmpty()) {
+            throw new GradleException(
+                "Generated Java is stale or churned:\n${dirty}\n" +
+                "Regenerate and commit after a .proto change, or 'git checkout' the spurious " +
+                "MxaccessGateway.java protobuf-version churn when no .proto changed.")
+        }
+    }
+}