fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests
  (semantic, protoc-free) so a missing contract symbol fails the build.
- IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized
  so it is protoc-version tolerant.
- IPC-19: document + guard the "Generated/ must be committed for net48" rule
  (docs/Contracts.md, csproj comment, check-codegen.ps1).
- IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned
  grpcio/protobuf/java version asserts) so regeneration is reproducible.
- TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the
  build, tests, client checks, and the codegen guards.
- Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift.

archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated,
not yet run on a Gitea runner). Verified on macOS: NonWindows build clean,
ClientProtoInputTests 5/5, -Check exit 0.

docs/Contracts.md

@@ -97,6 +97,24 @@ behavior.
 Generated C# output is written to `src/ZB.MOM.WW.MxGateway.Contracts/Generated/`. Do not
 hand-edit generated files.
 
+The `Generated/` C# is **tracked and must be committed after any `.proto` change.** The
+contracts project `Compile Remove`s `Generated/**/*.cs` and has `Grpc.Tools` regenerate them,
+but `Grpc.Tools` skips regeneration when the committed output looks up to date. On the net10
+build the freshly regenerated code is compiled, so a stale `Generated/` is invisible there —
+but the **net48 worker** consumes the committed `Generated/` and fails to build with `CS0246`
+on any new type when the checked-in code lags the `.proto`. So after editing a `.proto` you must
+regenerate and commit `Generated/`. If a build does not pick up your proto change, delete the
+stale output to force a full regeneration:
+
+```bash
+rm src/ZB.MOM.WW.MxGateway.Contracts/Generated/*.cs
+dotnet build src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csproj
+```
+
+`scripts/check-codegen.ps1` enforces this in CI (it force-regenerates and fails on any
+`git diff` against the committed `Generated/`); the Windows CI job's net48 worker build is the
+definitive guard.
+
 Client generation inputs are published through
 `clients/proto/proto-inputs.json` and the descriptor set under
 `clients/proto/descriptors/`. See
@@ -124,12 +142,25 @@ gateway and test projects:
 dotnet build src/ZB.MOM.WW.MxGateway.slnx
 ```
 
-Regenerate the client descriptor after changing either `.proto` file:
+Regenerate the client descriptor after changing either `.proto` file, using the pinned protoc
+(34.1, see [Toolchain Links](./ToolchainLinks.md)):
 
 ```bash
-powershell -ExecutionPolicy Bypass -File scripts/publish-client-proto-inputs.ps1
+pwsh -File scripts/publish-client-proto-inputs.ps1
 ```
 
+Freshness is guarded two ways so a skipped regeneration cannot ship silently:
+
+- `ClientProtoInputTests.Descriptor_ContainsEveryContractMessageAndField` (gateway test project)
+  reflects over the in-process contract descriptors and fails if any message or field is missing
+  from the committed protoset. It is semantic (symbol presence), needs no protoc, and runs in the
+  Linux CI. A red test means "regenerate and commit the protoset."
+- `pwsh -File scripts/publish-client-proto-inputs.ps1 -Check` rebuilds the descriptor and compares
+  it to the committed one. The comparison normalizes both sides through the same protoc with
+  `source_code_info` stripped, so it does not false-fail across protoc releases.
+- `pwsh scripts/check-codegen.ps1` runs both the descriptor check and the `Generated/`-clean check
+  together; it is the single guard the CI pipeline invokes.
+
 ## Related Documentation
 
 - [Client Proto Generation](./ClientProtoGeneration.md)