[rushd] Wire layer: protocol, transport & presentation (WS1)

[Sean Larkin (TheLarkInn)]

Part of #5894 (rushd epic). Implements the WS1 workstream of #5896 on top of current main.

Note: two acceptance criteria are intentionally deferred until the @rushstack/reporter stack (#5865-#5868) merges - see "Deferred to reporter reconciliation" below. This PR is complete and green on its own; it does not close #5896.

Summary

rushd needs an engine-agnostic wire layer that every client speaks, with presentation moved out of the engine. This PR lands that layer as three new standalone 0.x packages (merged incrementally, per the epic's strategy) plus additive-only instrumentation in rush-lib:

• @rushstack/rush-daemon-protocol - the frame taxonomy (0x01 control-json, 0x02/0x03 log-stdout/stderr, 0x04 stdin, 0x05 event), a length-prefixed binary codec with a split/coalesce-safe streaming decoder and max-frame guard, an exported DAEMON_PROTOCOL_VERSION, hello/helloAck version negotiation with a typed ProtocolVersionMismatchError, and a pure per-subscription verbosity filter applied at event serialization.
• @rushstack/rush-daemon-transport - workspace-key hashing (sha256(canonicalRepoRoot + rushVersion + startupOptions), NUL-separated, order-insensitive options), per-user runtime-dir socket/pipe path derivation ($XDG_RUNTIME_DIR on POSIX, \\.\pipe\rushd-<key> on Windows), a net listener/connector with drain-aware backpressure, and PID/lockfile handling with two-factor stale-socket reclaim (dead PID and failed connect probe, so a live but busy daemon is never reclaimed underneath itself).
• @rushstack/rush-terminal-renderer - the CLI client's presentation host: DaemonRendererHost hosts StreamCollator client-side for faithful per-operation collation (byte-parity with the legacy in-process pipeline, headers included), applies quiet/verbose per client without mutating shared state, and computes per-request FORCE_COLOR/COLUMNS for child spawns (non-TTY children get neither; ambient values are stripped first, so no cross-client contamination).
• rush-lib (patch, additive): an optional internal IOperationGraphEventSink on OperationGraph - every operation registration, status transition, ==[ x of y ]== header, and Colorize.* status line dual-emits as a structured event (operation-scoped and stream-tagged exactly where legacy writes them), each operation's raw stdout/stderr is tapped id-tagged upstream of the quiet-mode discard, and an explicit stream-closed event marks end-of-output. Terminal output is byte-identical with or without a sink.
• build-tests/rushd-wire-e2e-test - cross-layer conformance: engine dual-emit -> frames -> real socket pair -> renderer, asserting golden byte-parity with the in-process legacy output (normal and quiet, success and failure), exact per-operation raw bytes (unicode + ANSI), and per-client verbosity subsets.

Details

• Reporter-free by design (for now). The reporter stack is still unmerged, so the 0x05 event frame carries a placeholder envelope that mirrors IReporterEventEnvelope field-for-field, plus the closed core event union and rushd.* namespaced extension validation. A type-level test pins the placeholder key set so the swap to a referenced @rushstack/reporter import is mechanical. The renderer's IDaemonRenderer mirrors IReporter's method signatures so the real default/ai/plaintext reporters drop in unchanged.
• Stream ordering. Terminal status transitions fire before status-line text in the engine, while legacy closes the collated writer after; an explicit rushd.operation-stream-closed extension event carries the authoritative close, avoiding late-write ordering bugs.
• Quiet fidelity. Legacy quiet mode discards operation stdout but still prints status lines; the wire models this by routing operation-scoped status lines as required scoped activityChanged events (never filtered) while the client drops raw stdout chunks at display time.
• Strict codegen lint. The new packages share a strict-codegen ESLint mixin in local-node-rig (complexity 3, max-depth 3, 30-line functions, 100-line files, 4 params, no magic numbers, nullish coalescing, import hygiene, no eval) with noInlineConfig: true so eslint-disable comments are themselves errors, plus a per-package AGENTS.md codifying the no-suppression policy. Only rules already present in the repo's toolchain are enabled.
• No new external runtime dependencies; new packages carry no rush-lib dependency. API Extractor reports are committed for all three.

Deferred to reporter reconciliation (after #5865-#5868 merge)

• 0x05 payload becomes a direct IReporterEventEnvelope reference (acceptance item: "referenced, not re-declared").
• The renderer hosts the reporter package's real default/ai/plaintext reporters (acceptance item: "no re-implementation").

How it was tested

• New unit suites: protocol 29 tests (round-trip of all five frame types, non-UTF-8 losslessness, split/coalesce, oversized/unknown rejection, handshake match + typed mismatch, verbosity matrix, type-level contract pin), transport 17 tests (key stability/distinctness, POSIX+Windows path derivation, live socket exchange, stale reclaim vs live-daemon refusal, 16 MiB slow-consumer backpressure, negotiation over a real socket), renderer 10 tests (legacy byte-parity incl. quiet, per-client subsets, child-env matrix).
• rush-lib: new OperationGraphEventSink suite (transitions, headers, activity, quiet tap, byte-identical output with/without sink); full existing suite 736/736 unchanged.
• rush test --to rushd-wire-e2e-test green end to end; rush test --from @microsoft/rush-lib (147 operations across all dependents) green except pre-existing @rushstack/heft and @rushstack/node-core-library failures that reproduce identically on pristine main in this environment.
• rush change --verify passes; change files included for all touched packages.

Impacted documentation

N/A