chore(contract): sync flipcash2 protos to 4ccbbe43, release as 0.11.0

[bmc08gt]

Syncs the pinned contract from dd5e92db to
4ccbbe43,
picking up code-payments/flipcash2-protobuf-api#114 (GetRoster),
code-payments/flipcash2-protobuf-api#115 (a roster comment) and
code-payments/flipcash2-protobuf-api#116 (EditChat, plus
Permissions on ViewerState). Only chat/v1 moved. The second commit adds the 0.11.0 CHANGELOG
section, which is what publish.yml will use as the release notes.

What the contract adds

Chat.GetRoster pages a chat's roster, most recently joined first, capped at 100 per page with a
server-generated PagingToken bound to chat_id. Every page carries the chat's RosterSummary.
Pointers are hydrated for a DM's participants only. A member may read it, as may a non-member the
group's listener rules admit; a preview-only viewer is DENIED.

The page is not authoritative on its own. A DM's roster and a small group's are read whole at exactly
roster_summary.version, but a large group's is paged from an index that trails membership writes,
and the client cannot tell which case it is in. So a page has to be merged against what the event
stream already delivered, per member, by the new Member.version, the greater winning.

Chat.EditChat changes a group chat's title, picture, or both. Every field is optional, only the
ones set are changed, and the edit is atomic. It is gated on the new ViewerState.Permissions.can_edit
— server-computed and not derivable client-side, so the affordance shows if and only if the flag is
set. A new picture is a blob already uploaded through BlobStorage; the client passes the ORIGINAL's
BlobId once it is READY and the server derives the rest. EditChatResponse.Result carries
TITLE_MODERATED with a moderation.v1.FlaggedCategory, and PICTURE_BLOB_NOT_ACCEPTED.

Supporting model changes: Member.joined_at (4) and Member.version (5);
MetadataUpdate.TitleChanged (oneof 4) and PictureChanged (oneof 5), one per field actually
changed; ViewerState.permissions (2) and the nested Permissions.

Renumbering

None. Member 4–5 follow pointers (3), the two MetadataUpdate cases follow
viewer_state_changed (3), and ViewerState.permissions takes the free field 2 while version
stays at 10. Both new Result enums belong to new messages, so no positional rawValue mapping over
an existing enum shifts. Nothing existing changed number, type or meaning, and nothing was removed.

Release

Publish as 0.11.0 — additive only, so a minor bump. The two consumer PRs below pin that version
and stay in draft until it is on Central; they cannot go green before then, since app CI resolves the
pins and never sees the local override this was developed against.

Consumers

Both are drafts pinning 0.11.0, and both were verified against this branch's checkout via the
local override rather than a published artifact:

• feat(chat): scaffold GetRoster and EditChat code-android-app#1524 — :services:flipcash compiles, its tests and the
  chat / persistence module tests pass.
• feat(chat): scaffold GetRoster and EditChat code-ios-app#824 — ./Scripts/build.sh succeeds, 110 tests across 4 suites pass.

Merge this, publish 0.11.0, then mark both ready.