fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests
  (semantic, protoc-free) so a missing contract symbol fails the build.
- IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized
  so it is protoc-version tolerant.
- IPC-19: document + guard the "Generated/ must be committed for net48" rule
  (docs/Contracts.md, csproj comment, check-codegen.ps1).
- IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned
  grpcio/protobuf/java version asserts) so regeneration is reproducible.
- TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the
  build, tests, client checks, and the codegen guards.
- Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift.

archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated,
not yet run on a Gitea runner). Verified on macOS: NonWindows build clean,
ClientProtoInputTests 5/5, -Check exit 0.

docs/GatewayTesting.md

@@ -408,6 +408,34 @@ Run the gateway test project after shared gateway test infrastructure changes:
 dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj
 ```
 
+## Continuous Integration
+
+CI runs on Gitea Actions (`.gitea/workflows/ci.yml`; origin is Gitea at
+`gitea.dohertylan.com`) on every push and pull request. The pipeline is split by
+runtime because the x86 Worker cannot build on Linux:
+
+- **`portable`** (Linux runner) — builds `src/ZB.MOM.WW.MxGateway.NonWindows.slnx`,
+  runs the codegen/descriptor freshness guard (`scripts/check-codegen.ps1`), runs the
+  gateway fake-worker tests, and builds/tests the clients that run on Linux: .NET client
+  build, Go (`gofmt` + `go build` + `go test`), Rust (`cargo fmt --check` + `cargo test`
+  + `cargo clippy -D warnings`), and Python (`pytest`).
+- **`java`** (Linux, JDK 17) — `gradle test`. The protobuf gradle plugin rewrites
+  `MxaccessGateway.java` with spurious protobuf-runtime-version churn on every build, so
+  when no `.proto` changed the job reverts that one file (`git checkout`) before asserting
+  the generated tree is clean. The dev Mac has no JRE, so Java verification is CI-only.
+- **`windows`** (self-hosted windev runner) — the only host that builds the **x86 /
+  net48 Worker and Worker.Tests**; these are Windows-only and out of scope for the Linux
+  jobs. This job also proves the net48 build against the committed `Generated/` (the
+  definitive guard for the "regenerate and commit `Generated/`" rule).
+- **`live-mxaccess`** (self-hosted, MXAccess-installed) — scheduled only
+  (`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`); never gates a push.
+
+The freshness guard `scripts/check-codegen.ps1` fails the build when the committed
+client descriptor set or the C# `Generated/` no longer matches the current `.proto`
+sources — the codegen drift class this repo has hit repeatedly (stale client
+descriptors, net48 `CS0246` on unregenerated protos). See
+[Client Proto Generation](./ClientProtoGeneration.md) and [Contracts](./Contracts.md).
+
 ## Related Documentation
 
 - [Cross-Language Smoke Matrix](./CrossLanguageSmokeMatrix.md)