ci: publish proto schema to the Buf Schema Registry (#627)

* ci: publish proto module to BSR on push

Adds a buf-push job that publishes proto/ to buf.build/authorizerdev/authorizer.
Temporarily triggers on ci/buf-push to verify first publish; will narrow to main.

* ci: add dedicated Buf workflow for proto schema

Lint and breaking-change checks on PRs that touch proto/, and publish the
module to buf.build/authorizerdev/authorizer on push to main. Keeps proto
publishing out of the Go test/smoke pipeline.

Author: lakhansamani

.github/workflows/buf.yml

@@ -0,0 +1,49 @@
+---
+name: Buf
+
+# Proto schema CI for the `proto/` module (buf.build/authorizerdev/authorizer):
+# lint + breaking-change detection on PRs, publish to the BSR on push to main.
+on:
+  pull_request:
+    paths:
+      - "proto/**"
+      - ".github/workflows/buf.yml"
+  push:
+    branches: [main]
+    paths:
+      - "proto/**"
+      - ".github/workflows/buf.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  buf:
+    name: Lint, breaking & push
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: bufbuild/buf-setup-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Lint
+        run: buf lint proto
+
+      # Compare the proposed schema against the published module so a PR that
+      # would break wire/source compatibility fails before it lands.
+      - name: Breaking-change check
+        run: buf breaking proto --against buf.build/authorizerdev/authorizer
+        env:
+          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
+
+      # Publish only from main. buf de-dupes identical schemas, so commits that
+      # don't touch protos are no-ops.
+      - name: Push to BSR
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: buf push proto
+        env:
+          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}