transport: complete M0–M7

shared: add stream+consumer policy helpers; NATS context header builder

aggregate/runner/projection: centralize stream validation and header usage; set bounded consumer params

projection: add QueryService gRPC and wire into main; settings include PROJECTION_GRPC_ADDR

gateway: gRPC routing to Projection/Runner with deadlines; bounded read-only retries; pooled gRPC channels (bounded LRU+TTL); admin proxy forwards to gRPC; probes use concurrency limiter + TTL cache

runner: add RunnerAdmin gRPC server (drain, status, reload) and wire into main; settings include RUNNER_GRPC_ADDR

tests: add gateway authz for runner admin, projection tenant isolation, runner admin drain semantics

docs: update TRANSPORT_DEVELOPMENT_PLAN to reflect completed milestones and details

Cargo.lock

@@ -159,6 +159,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
+ "shared",
  "thiserror 2.0.18",
  "tokio",
  "tower 0.5.3",
@@ -3385,6 +3386,8 @@ dependencies = [
  "edge_storage",
  "futures",
  "libmdbx",
+ "prost 0.13.5",
+ "protoc-bin-vendored",
  "query_engine",
  "runtime-function",
  "serde",
@@ -3395,6 +3398,8 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "toml",
+ "tonic",
+ "tonic-build",
  "tower 0.5.3",
  "tracing",
  "tracing-subscriber",