fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests
  (semantic, protoc-free) so a missing contract symbol fails the build.
- IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized
  so it is protoc-version tolerant.
- IPC-19: document + guard the "Generated/ must be committed for net48" rule
  (docs/Contracts.md, csproj comment, check-codegen.ps1).
- IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned
  grpcio/protobuf/java version asserts) so regeneration is reproducible.
- TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the
  build, tests, client checks, and the codegen guards.
- Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift.

archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated,
not yet run on a Gitea runner). Verified on macOS: NonWindows build clean,
ClientProtoInputTests 5/5, -Check exit 0.

docs/ClientProtoGeneration.md

@@ -48,25 +48,55 @@ session.
 ## Descriptor Publishing
 
 Run this command after changing either source `.proto` file or the client proto
-manifest:
+manifest, with the **pinned protoc 34.1** (see [Toolchain Links](./ToolchainLinks.md)):
 
 ```powershell
-scripts/publish-client-proto-inputs.ps1
+pwsh -File scripts/publish-client-proto-inputs.ps1
 ```
 
 The script writes
 `clients/proto/descriptors/mxaccessgw-client-v1.protoset` with imports and
 source information included. The descriptor is a generated artifact; do not edit
-it by hand.
+it by hand. Generating the committed artifact requires the pinned protoc version
+so the checked-in bytes are reproducible; the script fails fast on a version
+mismatch when generating.
 
 Use the check mode in CI or before committing:
 
 ```powershell
-scripts/publish-client-proto-inputs.ps1 -Check
+pwsh -File scripts/publish-client-proto-inputs.ps1 -Check
 ```
 
-`-Check` rebuilds the descriptor in a temporary path and fails when the checked
-in descriptor is stale.
+`-Check` rebuilds the descriptor and fails when the checked-in descriptor is
+stale. The comparison normalizes both the committed and freshly built descriptor
+through the same protoc with `source_code_info` stripped, so it is tolerant of
+protoc-version encoding drift and does not false-fail across protoc releases
+(it warns, rather than fails, when protoc is off the pin).
+
+The gateway test project carries an independent, protoc-free freshness guard:
+`ClientProtoInputTests.Descriptor_ContainsEveryContractMessageAndField` reflects
+over the in-process contract descriptors and fails if any contract message or
+field is missing from the committed protoset. This is the primary CI gate for
+descriptor staleness; a red test means "regenerate and commit the protoset."
+
+### Pinned generator versions
+
+Regeneration is reproducible only with the pinned toolchain. Regenerating with a
+different version silently produces incompatible or noisy output, so the per-client
+scripts assert the pin and resolve tools from `PATH`:
+
+| Generator | Pinned version | Guard |
+|-----------|----------------|-------|
+| protoc (descriptor set) | 34.1 | version assertion in `scripts/publish-client-proto-inputs.ps1` |
+| `Grpc.Tools` (C# `Generated/`) | 2.80.0 (contracts csproj) | `scripts/check-codegen.ps1` git-diff of `Generated/` |
+| `grpcio-tools` (Python) | 1.80.0 (protobuf runtime 6.31.1) | version assertion in `clients/python/generate-proto.ps1` |
+| protobuf / grpc-java (Java) | `protobufVersion` / `grpcVersion` in `clients/java/build.gradle` | `checkGeneratedClean` gradle task |
+
+A newer `grpcio-tools` stamps a `GRPC_GENERATED_VERSION` above the pinned grpcio
+runtime and breaks Python `pytest`; the Java protobuf plugin rewrites
+`MxaccessGateway.java` with spurious protobuf-runtime-version churn on every build
+(revert that one file when no `.proto` changed — see
+[Gateway Testing](./GatewayTesting.md) "Continuous Integration").
 
 ## Output Directories