feat(core-runner-protocol): v0 message schemas with round-trip tests

Envelope pins protocolVersion "0" and carries the workspace-scoped
auth token; discriminated union on type covers hello/ready, clone,
install, scan, adapter-start, render-frame, status (stage + elapsed),
and error (named causes). All .strict() so the control plane, editor,
and runner cannot drift apart silently (ADR-027, PRD user story 7).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

packages/core-runner-protocol/src/envelope.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { PROTOCOL_VERSION } from "./protocol-version";
+import { runnerMessageSchema } from "./messages";
+
+/**
+ * The runner-protocol envelope (ADR-027): every wire message — both
+ * directions — is wrapped in it. Carries the pinned protocol version and
+ * the workspace-scoped auth token that the hello/ready handshake (and
+ * every subsequent message) is gated on.
+ */
+export const envelopeSchema = z
+  .object({
+    protocolVersion: z.literal(PROTOCOL_VERSION),
+    /**
+     * Workspace-scoped auth token. Scoped to exactly one workspace —
+     * possession authorizes talking to that workspace's runner and
+     * nothing else.
+     */
+    token: z.string().min(1),
+    message: runnerMessageSchema,
+  })
+  .strict();
+
+export type Envelope = z.infer<typeof envelopeSchema>;