proto becomes bxcore, the one shared crate (M5b task 00)

Done the way the owner asked and the spike mapped: the crate and the
manifests renamed, then what the build reported fixed. Layers: 138
"proto unresolved" errors across 169 files; cargo fmt reordering
imports; six fixture paths built as strings in brokerd's and bxctl's
tests, which the compiler cannot see, and comments naming
crates/proto/; the crate-dependency check and its self-test. One more
the spike did not reach: a `\nproto =` key inside a printf format in
the self-test, which a word-boundary replacement skips because `n` and
`p` are both word characters.

make gate: gate: ok, 944 tests; no new entry in /tmp.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/brokerd/src/runner.rs

@@ -5,8 +5,8 @@
 //!
 //! ```compile_fail
 //! let _ = brokerd::runner::RunSpec {
-//!     session: proto::SessionId::new("s1").unwrap(),
-//!     call: proto::CallId(1),
+//!     session: bxcore::SessionId::new("s1").unwrap(),
+//!     call: bxcore::CallId(1),
 //!     tool: brokerd::args::ToolName::Shell,
 //!     arguments: todo!(),
 //!     mounts: Vec::new(),
@@ -22,7 +22,7 @@
 
 use crate::args::{ToolArgs, ToolName};
 use crate::policy::{Decision, Label, SessionState};
-use proto::{CallId, SessionId, ToolResponse};
+use bxcore::{CallId, SessionId, ToolResponse};
 
 /// A directory mounted for one call: a path and whether the runtime may write to it.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -111,7 +111,7 @@ pub const REFUSING: &str = "no tool runner is configured: brokerd.toml has no [r
 
 /// Turn an allowed call into a `RunSpec`, run it, and answer. A `RunError`'s text reaches the
 /// model unchanged, so a runtime may only put a fixed sentence in it.
-pub fn run(decision: Decision, runtime: &dyn Runtime) -> proto::ToolResponse {
+pub fn run(decision: Decision, runtime: &dyn Runtime) -> bxcore::ToolResponse {
     let label = decision.label();
     let args = decision.args();
     let (mounts, egress) = match args {