chore(contract): sync flipcash2 protos to 35f99814

[bmc08gt]

Syncs to flipcash2-protobuf-api@35f99814, six commits on from the 797052dd this was pinned at:

• 3ff3aa91 Expand chat Metadata for groups (#93)
• 203b82ba Add chat_profile to blob AccessContext (#94)
• 48212aa8 Add RosterSummary and update EmojiReaction sequence to version to reflect usage (#95)
• abd0ed88 Fix RosterSummary validation (#96)
• da3e37f5 Add initial chat ruleset with minimum balance requirements (#97)
• 35f99814 Update chat rules to be a repeated with and introduce staff requirements (#98)

Intended release: 0.6.0. Source-breaking, so the minor bump carries it pre-1.0. The CHANGELOG.md entry is in this PR, since publish.yml reads the section matching the version it publishes and refuses a version with none.

What changed

Three proto files. Nothing was renumbered anywhere, so the wire format is unchanged and an old client keeps decoding new messages — but three fields were renamed in place, and those names are what consumers compile against.

Renames, same field numbers

File	Before	After
messaging/v1/model.proto	EmojiReaction.sequence (5)	EmojiReaction.version
messaging/v1/model.proto	ReactionUpdate.sequence (6)	ReactionUpdate.version
blob/v1/model.proto	AccessContext.profile (2)	AccessContext.user_profile

The messaging rename is a correction, not a semantic change: the value is a per-aggregate version advanced by one on every change, already documented as opaque and ordering-only, and the old name read as a position in the chat event sequence. It is neither that nor gapless. Last-writer-wins per (message, emoji), and per actor for reacted_by_self, as before.

The blob rename makes room for the new arm below. Because scope is a oneof, an exhaustive switch/when over it breaks twice: once on the renamed case, once on the added one.

Additions

blob.v1.AccessContext.scope gains chat_profile (3, common.v1.ChatId). It authorizes reading a chat's public profile picture and nothing else: the blob has to be a rendition of that chat's current picture, so renditions of a superseded picture stop resolving through it. That expiry is what separates it from the existing chat scope.

chat.v1.Metadata gains three fields, all additive:

• picture (9, blob.v1.Media) — group chats only, optional. This is why chat/v1/model.proto now imports blob/v1/model.proto for the first time.
• roster_summary (10, chat.v1.RosterSummary, required) — member_count is the roster's true size, where Metadata.members is only a subset for large groups. version advances by one on every membership-record change and is opaque: compare against the value you held, refetch on a difference, keep the greater value on a stream. There is no delta to fetch, only a refetch, and a profile change never moves it.
• rules (11, chat.v1.Rules) — group chats only; unset means no participation requirements, so existing chats are unaffected. listener gates reading and joining, speaker gates sending, each up to 32 entries and each independently optional. Speaker rules apply on top of listener rules. ListenerRules and SpeakerRules are separate messages with identical kind oneofs over minimum_balance and staff; StaffRequirement is empty and means UserFlags.is_staff; MinimumBalanceRequirement carries a required fiat amount plus a mints list capped at one entry today, repeated only so more can be allowed later.

No enum touched

No enum declaration or case changed anywhere in this sync, and no field was renumbered. That is the one change class whose downstream weight is invisible in a diff — iOS maps result enums positionally through Error*(rawValue:), so an inserted case silently renumbers every case after it. Nothing here does.

Consumers

Both app PRs are open and build against this checkout through the local override. They are drafts because they pin 0.6.0, which does not exist until this merges and publish.yml runs:

• Android: code-payments/code-android-app#1464
• iOS: code-payments/code-ios-app#769

scripts/toolchain.env is untouched, and Sources/ moved only in the three files proto/ did.