feat: commit generated Go code, consume via go get instead of submodule

Add go.mod, buf.gen.yaml, and generated gen/kafkamgmt/v1 so consumers
fetch this module directly via go get against the self-hosted Forgejo
host, with no local buf/protoc plugin installation required. Add a
codegen-check CI job to keep gen/ in sync with proto/.

README.md

@@ -1,32 +1,30 @@
 # kmsvc-proto
 
-Shared `kafkamgmt.v1` proto contract for the Kafka Management Service ecosystem (`kafaka_management_service`, `kmsvc-sdk`, `kmsvc-cli`).
+Shared `kafkamgmt.v1` proto contract and generated Go code for the Kafka Management Service ecosystem (`kafaka_management_service`, `kmsvc-sdk`, `kmsvc-cli`).
 
-This repo ships **`.proto` source + buf lint/breaking-change config only** — no generated code. Each consumer submodules this repo and runs its own `buf generate` with its own pinned plugin versions and `go_package` override (managed mode), so generated-runtime versions never need to match across repos — only the wire contract is shared.
+This repo ships **`.proto` source + pre-generated, committed Go code** (`gen/kafkamgmt/v1`). Generation happens once here, in this repo, not in every consumer. Consumers never install `buf`/`protoc` plugins — they just `go get` this module like any other Go dependency.
 
 ## Consuming this repo
 
 ```bash
-git submodule add https://forgejo.riotpiao.homelab.com/rock/kmsvc-proto.git proto
-git -C proto checkout v1.0.0   # pin to a tag, don't track a moving branch
+export GOPRIVATE=forgejo.riotpiao.homelab.com   # skip public proxy/sumdb for this host
+go get forgejo.riotpiao.homelab.com/rock/[email protected]
 ```
 
-Then point your own `buf.gen.yaml` at `proto/proto` (this repo's proto root) and use managed mode to set your module's own `go_package`:
-
-```yaml
-version: v2
-managed:
-  enabled: true
-  override:
-    - file_option: go_package
-      value: github.com/<you>/<your-module>/internal/genapi
-plugins:
-  - local: protoc-gen-go
-    out: internal/genapi
-    opt: paths=source_relative
-  - local: protoc-gen-go-grpc
-    out: internal/genapi
-    opt: paths=source_relative
+```go
+import kafkamgmtv1 "forgejo.riotpiao.homelab.com/rock/kmsvc-proto/gen/kafkamgmt/v1"
 ```
 
-See `PLAN.md` for the full rollout plan (tagging convention, server migration, SDK/CLI wiring).
+## Updating the contract
+
+```bash
+# edit proto/kafkamgmt/v1/queue_service.proto
+buf lint
+buf generate   # regenerates gen/ in place
+go build ./...
+git add -A && git commit -m "..." && git tag vX.Y.Z && git push --tags
+```
+
+CI (`buf-lint-and-breaking`) gates lint + breaking-change checks. CI (`codegen-check`) re-runs `buf generate` and fails if `gen/` doesn't match what's committed — never hand-edit `gen/`.
+
+See `PLAN.md` for the full rollout plan (tagging convention, server/SDK/CLI migration).