fix: herdr protocol drift is directional, and fields are the real contract

[lntvan166]

What and why

paddock would not start against the installed herdr at all. herdr 0.8.2
reports protocol 20, paddock pinned 19, and checkProtocol compared them with
!== — so any drift in either direction was a fatal startup error before a port
was bound:

paddock: herdr protocol mismatch
  paddock expects  19
  herdr reports    20

Regenerating changes two lines: the number and its comment. The status enum
is byte-identical. Nothing paddock reads moved between 19 and 20, so an integer
with no consequence took the whole dashboard down — and it will do so again on
every herdr release unless the policy changes.

The policy

scripts/protocol-guard.ts already encoded the asymmetry that matters: make types refuses to regenerate against an OLDER herdr, because that shrinks the
enums and silently narrows the contract, while an upgrade is allowed. The
runtime gate now matches it.

• Older herdr → throws, unchanged. It genuinely lacks what paddock reads.
• Newer herdr → accepted, reported once at INFO, and exposed as
  health.herdrProtocol so the drift is visible from a phone, not only a log.
• doctor scores older as 1 and newer as 0. install.sh reads that code,
  and herdr moving ahead is not a broken install.

What replaces the version comparison

A protocol number was never the contract. src/server/herdr/shape.ts checks the
fields paddock actually reads against the live agent.list response.

• Every reconcile, not just at startup. The protocol is read only when the
  daemon is first reached, so a long-lived paddock keeps working across a herdr
  upgrade and only a restart reveals the break. That is the ordinary case, not
  an edge one.
• REQUIRED fields only — pane_id, workspace_id, agent_status. name
  and terminal_title_stripped are ?: in HerdrAgentRaw and adapter.ts
  already falls back for both, so a pane that was never named legitimately lacks
  them. Checking those would report a protocol break on an ordinary install, and
  a check that cries wolf on normal data trains you to ignore it.
• Zero panes yields unknown, never broken. You cannot conclude a field is
  gone from no rows, and refusing because herdr happens to have nothing open
  would be a self-inflicted outage.
• Live data, not herdr api schema --json — for the reason doctor.ts
  already records: the CLI answers from the binary on disk while the socket
  answers from the running daemon, and the two disagree after an upgrade, which
  is the exact confusion this work exists to end.

A broken shape refuses at startup; once running it is logged on change and
exposed as health.schemaWarning. Rendering every agent in one wrong state, or
every row under the same label, is worse than not starting — the operator would
act on it.

Also fixed, found by the bump

Two tests in socket.test.ts hardcoded 19 and 20 as literals, so every
legitimate pin bump broke them: "matching" stopped matching, and "different"
became the new pin and stopped throwing. Both now derive from
HERDR_PROTOCOL, and the mismatch case uses an OLDER protocol deliberately, so
it stays valid under this policy. A test that fails on a routine regeneration is
noise that trains you to edit tests instead of reading them.

Verified against the live daemon

With the pin held at 19 against herdr's 20:

herdr protocol 20 is newer than this paddock (built for 19); verifying the fields paddock reads against agent.list
herdr: agent.list carries every field paddock reads
herdr event stream connected · subscribed { panes: 6 }
paddock listening on http://127.0.0.1:8799

/api/health reported herdrProtocol: 20, schemaWarning: null, 6 agents.

Reviewer note: numbering conflict with #5

Both this branch and #5 add a decision 13 — #5's is the quick-tunnel pairing
gate, this one is protocol drift. Each is numbered correctly against main, so
whichever merges second needs renumbering to 14. One line, but it will conflict.

Checklist

• make check && make check-clean && make test pass — 692 pass, 0 fail,
  tsc clean, scanner clean. Note this branch also GREENS a suite that was
  red on main: the drift test was failing there before this change.
• If this adds a test: I broke the thing it guards and watched it fail —
  empty-list-returns-ok, inspecting only the first agent, treating optional
  name as required, and a pin ahead of the installed herdr. Each failed the
  expected test, then was reverted.
• If this touches measurement or performance claims: the 19 → 20 diff being
  two lines with a byte-identical status enum is in the commit message.
• No hostnames, home paths, usernames, employer terms or real agent names.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.