refactor(proto): isolate gateway storage messages

[varshaprasad96]

Summary

Separates persistence-only protobuf messages from OpenShell's public API packages. The gateway now owns a private, versioned storage package while preserving existing payload bytes and stable database object routing.

Related Issue

Closes #3053

Changes

• Move seven storage-only messages into the server-private openshell.storage.v1 package and compile them only for the gateway.
• Remove storage-only symbols from public descriptors and regenerated Go SDK bindings; Python and TypeScript generation remain public-only.
• Add descriptor-derived gates for all 77 public RPCs, 13 durable roots, their transitive schemas, and their exact overlap.
• Add v0.0.116 payload fixtures that survive an on-disk SQLite reopen, current migrations, and current persistence loaders byte-for-byte.
• Document every dual-purpose persisted root and the separate public-wire/storage-migration compatibility policies.

Deviations from Plan

None — implemented as planned.

Testing

• mise run pre-commit passes
• mise run test passes
• mise run ci passes
• Unit tests added/updated
• E2E tests added/updated (not applicable; no runtime, sandbox, policy, or infrastructure path changed)

Tests added:

• Unit: private storage schema freeze, public SDK/descriptor exclusion, public/durable closure inventories, and v0.0.116 semantic decode coverage.
• Integration: on-disk SQLite fixture reopen through current migrations and persistence loaders with exact payload preservation.
• E2E: N/A; no files under e2e/ changed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

Documentation updated:

• architecture/gateway.md records storage classifications, per-root twin decisions, schema inventories, and compatibility policy.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.