refactor: Consume shared Cerebro proto from Go SDK

[jonathanhaaswriter]

Summary

Removes Aperio's copied cerebro/v1 protobuf and its forked proto bridge, consuming the canonical contract from the shared Cerebro Go SDK (github.com/writer/cerebro/sdk/go/cerebroapi) instead. This is the downstream half of cerebro#1143, which moved the proto contract + bridge into the SDK.

Why

The SDK now ships the generated cerebro/v1 proto and its Claim/EntityRef conversion bridge. Aperio's cerebroclient embeds *cerebroapi.Client, so once Aperio upgrades to that SDK it transitively registers cerebro/v1/primitives.proto. Keeping Aperio's own generated copy would register the same file descriptor a second time and panic at init (proto: file already registered). So adopting the new SDK and deleting the local copy must happen together.

Removes

• gen/cerebro/v1/primitives.pb.go (generated duplicate, -448 LOC)
• internal/cerebroclient/proto.go hand-maintained bridge body (now thin re-exports of the SDK)
• Aperio's local EncodeExternalID encoder body in cerebroclaims

Updates

• proto/cerebro/v1/primitives.proto go_package repointed to the SDK module. The .proto is kept because Aperio's own aperio.contracts.v1.CerebroClaimsFanoutEvent imports cerebro.v1.Claim.
• buf generation split into buf.gen.go.yaml (Go, run with --exclude-path proto/cerebro so the cerebro Go type comes from the SDK) and buf.gen.ts.yaml (TypeScript still generates cerebro/v1 locally; protobuf-es has no global-registry collision). make generate, npm run proto:generate, and the Contracts workflow run both.
• buf.yaml breaking config excepts FILE_SAME_GO_PACKAGE (go_package is a codegen detail being intentionally repointed; the wire contract is unchanged).
• cerebroclaims.EncodeExternalID now delegates to claims.EncodeExternalIDLegacy, which is byte-identical to the old encoder (space -> -). This preserves already-persisted Cerebro URNs.
• SDK bumped to the merged cerebro#1143 commit (784f5ee).

Test Plan

• go build ./...
• go vet ./...
• go test ./internal/cerebroclient/... ./internal/cerebroclaims/... ./internal/siemdispatcher/... ./internal/bootstrap/... ./internal/ingestionworker/... ./internal/cerebrofanout/... (the cerebroclient proto round-trip test passing also confirms no duplicate-registration panic)
• make generate-check (regeneration deterministic, no drift)
• gofmt -l clean on changed Go files

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

This is a well-executed refactor that cleanly removes the locally-duplicated cerebro/v1 proto and its hand-maintained conversion bridge, consuming both from the shared Cerebro Go SDK instead. All import paths, type aliases, and promoted methods are compatible with existing callers, the EncodeExternalID delegation is byte-identical to the old implementation, and the TypeScript file descriptor update is limited to the go_package codegen annotation with no wire-format change.

[github-actions]

Droid encountered an error —— View job

---

Droid is reviewing code and running a security check…

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Droid is reviewing code and running a security check…

---

This is a clean, well-scoped refactor. All callers are consistently updated to the SDK import path, the removed local proto and conversion bridge have no remaining callers, and EncodeExternalID delegates byte-identically to the SDK's legacy encoder. No correctness, security, or contract issues found.