Make offline dependency preparation and protocol packaging self-contained

[CoreyShupe]

Summary

• Add explicit FStack pre-materialization policy, Cargo vendoring and restore-only activation for reusable offline development dependencies.
• Package the canonical, byte-identical Protobuf/Buf inputs inside nakode-api, so a packaged or vendored API crate no longer requires files outside its crate.
• Preserve the telemetry RPC allowlist and update protocol-location documentation. Nakode's SQLite persistence and application behavior are unchanged.

Validation

• Packaged API offline build and protocol byte-equivalence verified.
• Retained standalone/workspace tests and separate all-target/all-feature Clippy passed; earlier failed aggregate receipts were not relabeled as successful.
• FStack consumer build and 350 Rust tests passed with this exact source pin, plus current-image dependency preparation, restoration, offline locked Cargo metadata and independent-write checks.
• PR Required checks remain the merge gate.

Release ordering

Merge this PR first. Wait for the Required workflow on the resulting main commit to publish runtime-<SHA>, then update FStack's SDK/runtime Cargo pins, lockfile and enrollment runtime manifest together using its established pin updater. Do not substitute an unreleased branch SHA for the released pin.

Accepted integration boundary

The owner authorized publication without further migration of the retained FStack smoke VM. That VM still runs an older runtime/CA; final-runtime strict TLS and persistence together after reboot remain unverified. Current-source certificate, controller-recovery and dependency-restoration tests pass separately. This PR does not claim to upgrade a running installation.