[rust] Check in generated protobuf code and drop protoc requirement

[seokjin0414]

Summary

• Closes [rust] fluss-rs requires a system protoc to build #3967. Re-targeted from [rust] Check in generated protobuf code and drop the protoc build requirement fluss-rust#662 after the Rust client moved into this repo; the old PR and Check in the prost-generated code so builds don't require protoc fluss-rust#661 are closed with pointers here. Downstream context: add apache Fluss source connector iggy#3688.
• FlussApi.proto only changes when the wire protocol does, but fluss-rust/crates/fluss/build.rs reran prost-build on every build, which makes a system protoc a requirement for every consumer of the fluss-rs crate and for CI. This checks the generated code in instead, following the arrow-flight layout: crates/fluss/src/proto/fluss.rs is the committed prost output (ASF header + do-not-edit notice), crates/fluss/gen is a tiny bin crate that regenerates it via crates/fluss/regen.sh, and build.rs plus the [build-dependencies] on prost-build are removed.
• gen always reads the canonical fluss-rpc/src/main/proto/FlussApi.proto and also refreshes a committed copy at crates/fluss/proto/FlussApi.proto, so the published crate and the source release ship the schema next to the generated code. A new test (tests/vendored_proto.rs) fails when the copy drifts from the canonical proto — no protoc needed — and the proto-up-to-date CI job reruns the full regeneration (protoc pinned to 27.1, failure message names regen.sh, regenerated files uploaded as an artifact). scripts/vendor-proto.sh and its callers are gone.
• With gen as the only protoc user left, every other protoc requirement is removed: the installs in client-integration.yml, python-release.yml (incl. the manylinux before-script), rust-release.yml, gateway-ci.yml and the Rust build/license workflows, the protoc gate and PROTOC plumbing in the C++ CMake and Bazel builds, and bindings/cpp/scripts/ensure_protoc.sh. fluss-gateway/Cargo.lock and its DEPENDENCIES.rust.tsv are regenerated since prost-build drops out of that graph. Docs that listed protoc as a build prerequisite are updated, and FlussApi.proto now points at regen.sh so Java-side changes do not silently skip the Rust regeneration.
• Generation is deterministic: prost-build is version-locked through Cargo.lock, and output is byte-identical across protoc 27.1 and 35.1.
• Once this is in a release, the protoc requirement disappears for every fluss-rs consumer; the two Fluss connectors in flight for Apache Iggy (feat(connectors): add Apache Fluss source connector iggy#3799, feat(connectors): add Apache Fluss sink iggy#3782) are currently blocked on exactly that.

Test Plan

• With no protoc installed, from fluss-rust/: cargo build, cargo test (689 passed, incl. the new vendored-proto test), cargo clippy --all-targets --workspace -- -D warnings, cargo fmt --all -- --check and cargo doc --no-deps with the CI excludes all pass; cargo deny check licenses passes.
• regen.sh reproduces both committed files byte-for-byte with protoc 27.1 (the CI pin) and 35.1; a full cargo package -p fluss-rs verify build passes, confirming the crate builds standalone with the vendored proto and no build script.
• fluss-gateway: cargo check --locked --all-targets passes with the regenerated lockfile; DEPENDENCIES.rust.tsv regenerated with cargo-deny 0.14.22 (the CI pin).
• CI was 23/23 green before the rebase; the re-run on the updated branch is pending workflow approval.

🤖 AI-assisted changes - reviewed by human developer

[seokjin0414]

@fresh-borzoni @charlesdong1991 Gentle ping when you have a moment — it would be great to catch the first release from the monorepo, since this removes the protoc requirement for fluss-rs consumers; the Apache Iggy connectors (apache/iggy#3799, apache/iggy#3782) are waiting on it. Happy to adjust anything!

[fresh-borzoni]

@seokjin0414 I'll take a look today, it's in my list, sorry for the long wait
Thank you!

[fresh-borzoni]

@seokjin0414 Thank you for the PR, it's a sensible addition 👍
Left some comments, PTAL

Needs a rebase + regen as the protos has changed.
The title isn't true yet either: protoc is still required in client-integration.yml, python-release.yml, rust-release.yml, gateway-ci.yml, bindings/cpp/CMakeLists.txt:67, BUILD.bazel:59 and scripts/ensure_protoc.sh.
After this PR gen is the only thing that calls protoc, so all of it is dead. CMake refuses to configure without protoc., so C++ users still can't build without it. Can we clear all of this here?

Small one: a comment in FlussApi.proto pointing at regen.sh would help. It feels useful as nothing on the Java side hints a Rust file needs regenerating.

[seokjin0414]

@fresh-borzoni
Rebased onto current main and regenerated. All the protoc leftovers are cleared in this PR: client-integration, python-release (incl. the manylinux before-script), rust-release, gateway-ci, the protoc gate and PROTOC plumbing in the C++ CMake/Bazel builds, and ensure_protoc.sh — gen via regen.sh is the only protoc user left. Also added the pointer comment in FlussApi.proto and updated the docs.

One knock-on change: with no build script, prost-build drops out of the fluss-gateway graph, so its Cargo.lock and DEPENDENCIES.rust.tsv are regenerated here (the gateway drift check would fail otherwise).

[fresh-borzoni]

@seokjin0414 Thank you, LGTM overall 👍

I've added some fixes for bazel build and tarball regeneration.
Let me know if you are okay with it. I'll be ready to merge once CI passes

[seokjin0414]

@fresh-borzoni
Both fixes look right — good catch on regen inside the source tarball; I verified a fluss-rust-only archive regenerates fluss.rs byte-identically via the vendored copy. Good to merge from my side, thanks!