feat: Define Operational Gateway proto contracts (#1303)

* feat: Define Operational Gateway proto contracts

Add operational_gateway.proto with:
- InstructionStatus, Priority, Protocol, HealthStatus enums
- Instruction and InstructionAttempt messages (full dispatch envelope)
- ProviderConnection with oneof AuthConfig (ApiKey, Basic, OAuth2, HMAC, mTLS)
- RetryPolicy and RateLimit configuration messages
- InstructionRoute for mapping instruction_type to connection + HTTP path
- CallbackPayload for inbound provider acknowledgements
- OperationalGatewayService (Dispatch, Cancel, Get, List, ProcessCallback)
- ProviderConnectionService (Upsert, Get, List, TestConnection)
- Full buf.validate annotations and google.api.http REST transcoding

* fix: Address CodeRabbit review - URI validation and callback constraint

- Add string.uri = true validation to OAuth2Auth.token_url and
  ProviderConnection/UpsertConnectionRequest base_url fields
- Add message-level CEL rule to ProcessCallbackRequest enforcing
  at least one of instruction_id or provider_reference is provided
- Clarify auth_config oneof comment: exactly-one enforcement at Go service layer

* fix: Address CodeRabbit review - oneof required, RetryPolicy bounds, status filter validation

- Add `option (buf.validate.oneof).required = true` to both auth_config oneofs
  in ProviderConnection and UpsertConnectionRequest so protovalidate enforces
  exactly-one auth variant at the schema level
- Add message-level CEL rule to RetryPolicy ensuring max_backoff_seconds is
  greater than or equal to initial_backoff_seconds
- Reject INSTRUCTION_STATUS_UNSPECIFIED in ListInstructionsRequest.status filter
  by adding items enum validation with not_in: [0]

---------

Co-authored-by: Ben Coombs <bjcoombs@users.noreply.github.com>

Author: bjcoombs