feat(proto)!: Shamir re-key, governance and bootstrapping vault state

Split out of feat-shamir so the wire contract can be reviewed on its own.
Rebased onto main: main's UNSEAL_RESULT_LOCKED_OUT keeps tag 4, so
UNSEAL_RESULT_AWAITING_CONTRIBUTIONS moved to 5.

BREAKING CHANGE: `shared.VaultState` renumbers SEALED/UNSEALED/ERROR to
make room for VAULT_STATE_BOOSTRAPPING = 2. Old and new peers disagree on
every vault state value.

- operator: new `governance` branch in OperatorRequest/Response (field 5)
- vault: new `rekey` branch in vault Request/Response (field 4)
- bootstrap/unseal: passphrase and recovery-passphrase contribution payloads

protobufs/operator/vault/unseal.proto

@@ -15,18 +15,30 @@ message UnsealEncryptedKey {
   bytes associated_data = 3;
 }
 
+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
+message ContributeRecoveryPassphrase {
+  int32 recovery_operator_id = 1;
+  bytes passphrase            = 2;
+}
+
 enum UnsealResult {
   UNSEAL_RESULT_UNSPECIFIED = 0;
   UNSEAL_RESULT_SUCCESS = 1;
   UNSEAL_RESULT_INVALID_KEY = 2;
   UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
   UNSEAL_RESULT_LOCKED_OUT = 4;
+  UNSEAL_RESULT_AWAITING_CONTRIBUTIONS = 5;
 }
 
 message Request {
   oneof payload {
-    UnsealStart start = 1;
-    UnsealEncryptedKey encrypted_key = 2;
+    UnsealStart                  start                          = 1;
+    UnsealEncryptedKey           encrypted_key                  = 2;
+    ContributePassphrase         contribute_passphrase          = 3;
+    ContributeRecoveryPassphrase contribute_recovery_passphrase = 4;
   }
 }