transport: complete M0–M7

shared: add stream+consumer policy helpers; NATS context header builder

aggregate/runner/projection: centralize stream validation and header usage; set bounded consumer params

projection: add QueryService gRPC and wire into main; settings include PROJECTION_GRPC_ADDR

gateway: gRPC routing to Projection/Runner with deadlines; bounded read-only retries; pooled gRPC channels (bounded LRU+TTL); admin proxy forwards to gRPC; probes use concurrency limiter + TTL cache

runner: add RunnerAdmin gRPC server (drain, status, reload) and wire into main; settings include RUNNER_GRPC_ADDR

tests: add gateway authz for runner admin, projection tenant isolation, runner admin drain semantics

docs: update TRANSPORT_DEVELOPMENT_PLAN to reflect completed milestones and details

gateway/build.rs

@@ -1,12 +1,25 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let proto_path = "../aggregate/proto/aggregate.proto";
-    let proto_dir = "../aggregate/proto";
+    let protoc = protoc_bin_vendored::protoc_bin_path()?;
+    std::env::set_var("PROTOC", protoc);
 
     tonic_build::configure()
         .build_server(true)
         .build_client(true)
-        .compile_protos(&[proto_path], &[proto_dir])?;
+        .compile_protos(
+            &[
+                "../aggregate/proto/aggregate.proto",
+                "../projection/proto/query.proto",
+                "../runner/proto/admin.proto",
+            ],
+            &[
+                "../aggregate/proto",
+                "../projection/proto",
+                "../runner/proto",
+            ],
+        )?;
 
-    println!("cargo:rerun-if-changed={}", proto_path);
+    println!("cargo:rerun-if-changed=../aggregate/proto/aggregate.proto");
+    println!("cargo:rerun-if-changed=../projection/proto/query.proto");
+    println!("cargo:rerun-if-changed=../runner/proto/admin.proto");
     Ok(())
 }