feat: enforce per-method effect/network policy on the Solution contract (#289)

[antoinetoussaint-byte]

Closes#289.

Stacked on #288 (adds the Solution contract); base this PR on issue-287-... until #288 merges, then it retargets main.

Summary

• The Solution RPCs (Package pushes an OCI artifact, Render/Create/Update mutate the filesystem) previously documented their side effects in comments only — the decorative-annotation smell New agent kind: codefly:solution — registry entry, proto enum, manifest schema, proto service #287 deliberately avoided. This binds a machine-readable ceiling to each RPC and enforces it at the host's dispatch boundary.
• Adds a solution_method_policy extension mirroring provider_method_policy, with solution-specific vocabularies (SolutionNetworkMode, SolutionEffect) ordered so a host ceiling admits every mode/effect at or below it. Each RPC is annotated with its true network reach and state effect.
• Adds the host-side dispatch gate and wires it in: solution.EnforcingClientInterceptor is installed in agents/manager.loader's grpc.NewClient dial options — the single factory for every agent connection. It reads each outgoing Solution RPC's declared policy and the ceiling stamped on the call context (solution.WithCeiling), and fails the call closed (PermissionDenied) before it crosses the wire when the declared ceiling exceeds the admitted one, or when no ceiling is present. It no-ops for every non-Solution method, so it is safe on all existing agent connections.

Ceiling is per-call, not per-dial

AgentConn.GRPCConn hands out one long-lived connection reused across operations, so the admitted ceiling belongs to the operation (the call), not the transport (the dial). The interceptor therefore reads the ceiling from the call context; a Solution RPC issued without one is refused.

What this gate does and does not do

The gate constrains what the host chooses to invoke — it does not, and under this contract cannot, constrain what a solution executor actually does inside a handler. Unlike provider.proto (where ProviderHost brokers the provider's side effects and the host enforces at the point of effect), the Solution contract has no host-brokered callback path, so a plugin's real filesystem/registry writes are unmediated. Enforcing declared effects against plugin behavior would require a broker this contract does not define.

Test plan

• go build ./...
• go test -race ./solution/... — contract test asserts every RPC carries the expected policy; TestSolutionContractIsUnaryOnly guards the invariant the unary-only gate relies on; TestSolutionMethodPolicyAxesAreCoherent asserts registry-network ⟺ registry-effect so an incoherent annotation (e.g. push-while-offline) fails the build; admission unit tests cover both axes and every fail-closed path; a real bufconn gRPC server verifies an over-ceiling Package and a no-ceiling Create are denied before reaching the server while an at-ceiling Create is admitted; a pass-through test confirms non-Solution methods dispatch with no ceiling.
• go test ./agents/manager/ — the dial-path change leaves existing agent loading green (interceptor no-ops for non-Solution methods).
• go test ./provider/ — provider contract unaffected.
• codefly generate proto --local reproduces the committed generated code. Verified empirically that the committed solution_grpc.pb.go and a fresh regen differ only in the protoc-gen-go-grpc header line (v1.6.1 committed vs v1.6.2 locally installed) — bodies are byte-identical — so the header is reverted to match feat: add codefly:solution agent kind (#287) #288's baseline rather than churn 14 unrelated _grpc.pb.go files. The go-grpc version pin lives in the codefly binary, not this repo.