transport: complete M0–M7

shared: add stream+consumer policy helpers; NATS context header builder

aggregate/runner/projection: centralize stream validation and header usage; set bounded consumer params

projection: add QueryService gRPC and wire into main; settings include PROJECTION_GRPC_ADDR

gateway: gRPC routing to Projection/Runner with deadlines; bounded read-only retries; pooled gRPC channels (bounded LRU+TTL); admin proxy forwards to gRPC; probes use concurrency limiter + TTL cache

runner: add RunnerAdmin gRPC server (drain, status, reload) and wire into main; settings include RUNNER_GRPC_ADDR

tests: add gateway authz for runner admin, projection tenant isolation, runner admin drain semantics

docs: update TRANSPORT_DEVELOPMENT_PLAN to reflect completed milestones and details

runner/proto/admin.proto

@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package runner.admin.v1;
+
+service RunnerAdmin {
+  rpc Drain(DrainRequest) returns (AdminResponse);
+  rpc DrainStatus(DrainStatusRequest) returns (AdminResponse);
+  rpc Reload(ReloadRequest) returns (AdminResponse);
+}
+
+message DrainRequest {
+  string tenant_id = 1;
+  uint64 wait_ms = 2;
+}
+
+message DrainStatusRequest {
+  string tenant_id = 1;
+}
+
+message ReloadRequest {}
+
+message AdminResponse {
+  uint32 http_status = 1;
+  string json = 2;
+}