Split out of feat-shamir so the wire contract can be reviewed on its own.
Rebased onto main: main's UNSEAL_RESULT_LOCKED_OUT keeps tag 4, so
UNSEAL_RESULT_AWAITING_CONTRIBUTIONS moved to 5.

BREAKING CHANGE: `shared.VaultState` renumbers SEALED/UNSEALED/ERROR to
make room for VAULT_STATE_BOOSTRAPPING = 2. Old and new peers disagree on
every vault state value.

- operator: new `governance` branch in OperatorRequest/Response (field 5)
- vault: new `rekey` branch in vault Request/Response (field 4)
- bootstrap/unseal: passphrase and recovery-passphrase contribution payloads

@@ -0,0 +20,4 @@
+    ApprovePersistentGrantPayload   approve_persistent_grant    = 7;
+    ApproveOneOffTransactionPayload approve_one_off_transaction = 8;
+  }
+  optional uint32 ttl_secs = 2;

@@ -0,0 +76,4 @@
+
+message ProposalSummary {
+  int32  id            = 1;
+  string kind          = 2;

@@ -0,0 +108,4 @@
+  repeated VolumeLimitProto volume_limits  = 3;
+}
+
+message ApproveOneOffTransactionPayload {

@@ -0,0 +121,4 @@
+  bytes  input                    = 10;
+}
+
+message ApprovePersistentGrantPayload {

@@ -20,3 +39,4 @@
+  }
 }
 
 message Response {