transport: complete M0–M7

shared: add stream+consumer policy helpers; NATS context header builder

aggregate/runner/projection: centralize stream validation and header usage; set bounded consumer params

projection: add QueryService gRPC and wire into main; settings include PROJECTION_GRPC_ADDR

gateway: gRPC routing to Projection/Runner with deadlines; bounded read-only retries; pooled gRPC channels (bounded LRU+TTL); admin proxy forwards to gRPC; probes use concurrency limiter + TTL cache

runner: add RunnerAdmin gRPC server (drain, status, reload) and wire into main; settings include RUNNER_GRPC_ADDR

tests: add gateway authz for runner admin, projection tenant isolation, runner admin drain semantics

docs: update TRANSPORT_DEVELOPMENT_PLAN to reflect completed milestones and details

runner/src/main.rs

@@ -83,6 +83,16 @@ async fn serve() {
         .await
     });
 
+    let grpc_addr: std::net::SocketAddr = settings.grpc_addr.parse().unwrap();
+    let grpc_shutdown = shutdown.clone();
+    let grpc_state = state.clone();
+    let grpc_task = tokio::spawn(async move {
+        runner::grpc_admin::serve(grpc_addr, grpc_state, async move {
+            grpc_shutdown.notified().await
+        })
+        .await
+    });
+
     let signal_shutdown = shutdown.clone();
     let signal_draining = draining.clone();
     tokio::spawn(async move {
@@ -278,6 +288,7 @@ async fn serve() {
     draining.store(true, Ordering::Relaxed);
     shutdown.notify_waiters();
     let _ = http_task.await;
+    let _ = grpc_task.await;
 
     if let Some(e) = failed {
         tracing::error!(error = %e, "Runner terminated with error");