Protobuf and gRPC CI on GitHub Actions

Code generation runs on every build even when no .proto changed.

Why it happens

protoc plugins are installed per run and generation is not gated on proto changes.

What to change

1. Cache the protoc plugin binaries keyed on their versions
2. Use buf with a lockfile so dependency modules are cached
3. Gate generation on a path filter for **/*.proto
4. Check generated code into the repository and verify it in CI rather than regenerating

Protobuf and gRPC on runnerhut

jobs:
  generate:
    runs-on: runnerhut-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
      - uses: bufbuild/buf-action@v1
        with: { setup_only: true }
      - run: buf generate && git diff --exit-code

The only runnerhut-specific line is `runs-on: runnerhut-4vcpu-ubuntu-2404`. Everything else is standard GitHub Actions — the same actions, the same secrets and the same permissions model you use today.