Move sebuf codegen out of PRs into CI/CD

[SebastienMelki]

Problem

Right now, src/generated/ (~68 files) is committed to the repo. Any change to proto/ — or a sebuf version bump — forces the contributor to also commit the full regenerated client/server output in the same PR. This:

• Makes PRs hard to review (the generated diff drowns out the actual proto or config change — see e.g. the current feat/unified-openapi-bundle PR).
• Creates merge-conflict churn between concurrent proto PRs.
• Requires every contributor to have the exact pinned sebuf version installed, matching the Makefile sed post-processing byte-for-byte, or the proto-check.yml workflow fails.

Current state (verified)

• .github/workflows/proto-check.yml only checks freshness — it runs make generate in CI, then git diff --exit-code to confirm the committed files match what CI produced.
• It does not commit regenerated output back to the branch.
• The local .husky/pre-push hook mirrors the same check.

So we're paying the CI-install-sebuf-plugins cost on every PR, but still making humans carry the generated diff.

Proposal

Pick one:

1. Generate in CI, commit on behalf of the author.

   • On PR pushes that touch proto/** or bump SEBUF_VERSION, the workflow runs make generate and commits src/generated/, docs/api/ back to the PR branch via a bot token.
   • PR diff stays focused on the proto/doc change; generated output is an auto-appended commit.
   • Simple; preserves current "commit the generated files" contract.

2. Remove src/generated/ from the repo entirely.

   • Add to .gitignore.
   • Run make generate as a pre-step in npm run build, npm run typecheck, and the Vercel build command.
   • No generated diff in PRs ever; tradeoff is every contributor must run make install-plugins once.

Option 2 is cleaner long-term but larger blast radius (Vercel config, local dev, every CI job). Option 1 is the minimum change that fixes the reviewer pain.

Scope

• Decide between (1) and (2) — bias toward (1) as a stepping stone.
• If (1): add push permission, write a workflow step that runs make generate, detects drift, commits with a bot identity, and pushes to the PR branch. Preserve the existing freshness check as a fallback.
• Update CONTRIBUTING.md so contributors know not to commit src/generated/ changes manually.
• Verify the worldmonitor.openapi.yaml unified bundle is also regenerated by the same pipeline.

Motivation

Context: introduced as part of the sebuf v0.11.0 bump + unified OpenAPI bundle PR, where the generated diff was ~69 files / 181 line deletions that had nothing to do with the actual change. That PR explicitly called out the need for this issue.