fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests
  (semantic, protoc-free) so a missing contract symbol fails the build.
- IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized
  so it is protoc-version tolerant.
- IPC-19: document + guard the "Generated/ must be committed for net48" rule
  (docs/Contracts.md, csproj comment, check-codegen.ps1).
- IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned
  grpcio/protobuf/java version asserts) so regeneration is reproducible.
- TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the
  build, tests, client checks, and the codegen guards.
- Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift.

archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated,
not yet run on a Gitea runner). Verified on macOS: NonWindows build clean,
ClientProtoInputTests 5/5, -Check exit 0.

clients/python/generate-proto.ps1

@@ -1,15 +1,52 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# Pinned generator baseline. The committed Python bindings are stamped with
+# GRPC_GENERATED_VERSION = 1.80.0 and "Protobuf Python Version: 6.31.1". A newer grpcio-tools
+# stamps a higher GRPC_GENERATED_VERSION than the pinned grpcio runtime (pyproject.toml:
+# grpcio>=1.80,<2), which makes _pb2_grpc import raise at runtime and breaks pytest. Regeneration
+# MUST use this exact grpcio-tools version. See docs/ClientProtoGeneration.md and the repo memory
+# project_python_client_regen_pin.
+$PinnedGrpcioToolsVersion = '1.80.0'
+
 $repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..\..')
 $protoRoot = Join-Path $repoRoot 'src\ZB.MOM.WW.MxGateway.Contracts\Protos'
 $outputRoot = Join-Path $PSScriptRoot 'src\zb_mom_ww_mxgateway\generated'
-$python = 'C:\Users\dohertj2\AppData\Local\Programs\Python\Python312\python.exe'
 
-if (-not (Test-Path $python)) {
-    throw "Python was not found at $python. See docs/ToolchainLinks.md."
+function Resolve-Python {
+    # Prefer python on PATH (python on Windows, python3 on Linux/macOS), then the documented
+    # Windows install location. Avoids the previous hard-coded per-machine path.
+    foreach ($name in @('python', 'python3', 'python.exe')) {
+        $cmd = Get-Command $name -ErrorAction SilentlyContinue
+        if ($null -ne $cmd) {
+            return $cmd.Source
+        }
+    }
+
+    if ($env:LOCALAPPDATA) {
+        $documentedPath = Join-Path $env:LOCALAPPDATA 'Programs\Python\Python312\python.exe'
+        if (Test-Path $documentedPath) {
+            return $documentedPath
+        }
+    }
+
+    throw 'Could not find python on PATH. See docs/ToolchainLinks.md.'
 }
 
+function Assert-GrpcioToolsVersion {
+    param([string]$Python)
+
+    $version = (& $Python -c 'import grpc_tools; from importlib.metadata import version; print(version("grpcio-tools"))').Trim()
+    if ($version -ne $PinnedGrpcioToolsVersion) {
+        throw "grpcio-tools $version is installed, but regeneration is pinned to $PinnedGrpcioToolsVersion. " +
+            "Install the pin (python -m pip install 'grpcio-tools==$PinnedGrpcioToolsVersion') before regenerating, " +
+            "or the generated bindings will stamp a GRPC_GENERATED_VERSION the pinned grpcio runtime rejects."
+    }
+}
+
+$python = Resolve-Python
+Assert-GrpcioToolsVersion -Python $python
+
 New-Item -ItemType Directory -Path $outputRoot -Force | Out-Null
 Get-ChildItem -Path (Join-Path $outputRoot '*_pb2.py') -File | Remove-Item
 Get-ChildItem -Path (Join-Path $outputRoot '*_pb2_grpc.py') -File | Remove-Item
@@ -21,3 +58,7 @@ Get-ChildItem -Path (Join-Path $outputRoot '*_pb2_grpc.py') -File | Remove-Item
     mxaccess_gateway.proto `
     mxaccess_worker.proto `
     galaxy_repository.proto
+
+if ($LASTEXITCODE -ne 0) {
+    throw "grpc_tools.protoc failed with exit code $LASTEXITCODE."
+}