Add buf lint/breaking targets and fix proto naming violations

- Add buf.yaml with STANDARD lint rules and FILE-level breaking change detection
- Add proto-lint Makefile target (buf lint + buf breaking --against master)
- Add lint Makefile target (golangci-lint) and include it in all
- Fix proto target: use module= option so protoc writes to gen/ not proto/
- engine.proto: rename rpc Request→Execute and message types accordingly
- acme.proto: drop redundant ACME prefix from SetConfig/ListAccounts/ListOrders messages
- policy.proto: add CreatePolicyResponse/GetPolicyResponse wrappers instead of returning PolicyRule directly from multiple RPCs
- Update grpcserver and webserver/client.go to match renamed types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/grpcserver/engine.go

@@ -68,7 +68,7 @@ func (es *engineServer) ListMounts(_ context.Context, _ *pb.ListMountsRequest) (
 	return &pb.ListMountsResponse{Mounts: pbMounts}, nil
 }
 
-func (es *engineServer) Request(ctx context.Context, req *pb.EngineRequest) (*pb.EngineResponse, error) {
+func (es *engineServer) Execute(ctx context.Context, req *pb.ExecuteRequest) (*pb.ExecuteResponse, error) {
 	if req.Mount == "" || req.Operation == "" {
 		return nil, status.Error(codes.InvalidArgument, "mount and operation are required")
 	}
@@ -108,5 +108,5 @@ func (es *engineServer) Request(ctx context.Context, req *pb.EngineRequest) (*pb
 	if err != nil {
 		return nil, status.Error(codes.Internal, "failed to encode response")
 	}
-	return &pb.EngineResponse{Data: pbData}, nil
+	return &pb.ExecuteResponse{Data: pbData}, nil
 }