feat(schema): protobuf event registry + buf CI gate (#54)

- Add proto schemas in packages/shared-types/events/ (oo.events.v1):
  envelope.proto, signals.proto, integration.proto
- buf.yaml with STANDARD lint + FILE breaking-change rules
- .gitea/workflows/buf-check.yaml: lint + breaking check on every PR
  touching events/ (needs a Gitea Actions runner to execute)
- scripts/buf-check.sh: local equivalent of the CI check
- NormalizedEvent TS envelope gains eventId, schemaVersion, producer
  to align with the proto Envelope message
- ml/serving/schemas.py: pydantic models mirroring the v1 proto types
- nats_consumer.py: validate payloads via pydantic instead of raw .get()

A field-rename PR will now fail buf breaking with exit code 100 and
show the offending messages. To make a breaking change: keep the old
field reserved, add the new one, bump schema_version to v2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/buf-check.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Run buf lint and breaking-change detection locally.
+# Usage: ./scripts/buf-check.sh [against-branch]
+# Default against-branch: main
+set -euo pipefail
+
+AGAINST="${1:-main}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+EVENTS="$ROOT/packages/shared-types/events"
+
+if ! command -v buf &>/dev/null; then
+  echo "buf not found. Install: https://buf.build/docs/installation"
+  echo "  curl -sSfL https://github.com/bufbuild/buf/releases/latest/download/buf-Linux-x86_64 -o /usr/local/bin/buf && chmod +x /usr/local/bin/buf"
+  exit 1
+fi
+
+echo "==> buf lint"
+buf lint "$EVENTS"
+
+echo "==> buf breaking against $AGAINST"
+buf breaking "$EVENTS" \
+  --against ".git#branch=${AGAINST},subdir=packages/shared-types/events"
+
+echo "All checks passed."