chore(fbs): pin flatc toolchain to 25.9.23 and guard codegen drift

The committed FlatBuffers bindings were generated by flatc 25.x (the TS
runtime is flatbuffers@25.9.23), but nothing pinned the compiler, so a
regen on a box with an older flatc (Debian apt ships 23.5.26) silently
churns output and flips nullable-scalar builder defaults. PR #82 hit this
and shipped 5 report files from the wrong compiler.

Unify the whole toolchain on 25.9.23 (the only version available as an
npm package, a prebuilt flatc binary, and a Go tag) and make the bindings
reproducible:

- Downgrade the flatbuffers Go module 25.12.19 -> 25.9.23 (schema,
  transcoder, gateway, integration) so compiler and both runtimes match.
- Regenerate every schema with flatc 25.9.23. The only resulting change
  is order/command-item.ts: the lone straggler still on the old
  optional-scalar builder default (cmd_applied/cmd_error_code: 0 -> null).
  Inert in practice — the TS side never builds those response-only fields
  (the engine sets them in Go); the reader is unchanged.
- Pin the version in tooling: a flatc-check guard in ui/Makefile (fbs-ts)
  and a new pkg/schema/fbs/Makefile (fbs-go); both refuse a mismatched
  flatc and point at the release binary. Fix the stale apt install hint.
- Add a path-filtered CI guard (.gitea/workflows/fbs-codegen.yaml) that
  regenerates with the pinned flatc and fails on any diff.
- Document the pinned version and the regen commands in the schema README.

No wire-format change: Go build/vet, transcoder roundtrip + engine tests,
pnpm check and the full vitest suite (888) stay green.

.gitea/workflows/fbs-codegen.yaml

@@ -0,0 +1,80 @@
+name: Tests · FBS codegen
+
+# Guards that the committed FlatBuffers bindings (Go under
+# pkg/schema/fbs/<schema>/ and TS under ui/frontend/src/proto/galaxy/fbs/)
+# are exactly what the pinned flatc produces from the .fbs schemas.
+# Catches both "changed a schema but forgot to regenerate" and
+# "regenerated with the wrong flatc version" (e.g. a distro's older
+# flatbuffers-compiler), which silently churns output and can flip
+# nullable-scalar wire defaults. Path-filtered so it only runs when the
+# schemas, the generated trees, the fbs Makefiles, or this workflow change.
+
+on:
+  push:
+    paths:
+      - 'pkg/schema/fbs/**'
+      - 'ui/frontend/src/proto/galaxy/fbs/**'
+      - 'ui/Makefile'
+      - '.gitea/workflows/fbs-codegen.yaml'
+  pull_request:
+    paths:
+      - 'pkg/schema/fbs/**'
+      - 'ui/frontend/src/proto/galaxy/fbs/**'
+      - 'ui/Makefile'
+      - '.gitea/workflows/fbs-codegen.yaml'
+
+concurrency:
+  group: fbs-codegen-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FLATC_VERSION: 25.9.23
+
+jobs:
+  codegen:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Cache flatc
+        id: cache-flatc
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/flatc-bin
+          key: flatc-${{ env.FLATC_VERSION }}-linux-g++13
+
+      - name: Install pinned flatc
+        if: steps.cache-flatc.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p "${{ runner.temp }}/flatc-bin"
+          curl -sSL -o /tmp/flatc.zip \
+            "https://github.com/google/flatbuffers/releases/download/v${FLATC_VERSION}/Linux.flatc.binary.g++-13.zip"
+          python3 -m zipfile -e /tmp/flatc.zip "${{ runner.temp }}/flatc-bin"
+          chmod +x "${{ runner.temp }}/flatc-bin/flatc"
+
+      - name: Add flatc to PATH
+        run: echo "${{ runner.temp }}/flatc-bin" >> "$GITHUB_PATH"
+
+      - name: Verify flatc version
+        run: flatc --version
+
+      - name: Regenerate Go + TS bindings
+        run: |
+          make -C pkg/schema/fbs fbs-go
+          make -C ui fbs-ts
+
+      - name: Assert no drift
+        run: |
+          if ! git diff --exit-code || [ -n "$(git status --porcelain)" ]; then
+            echo "::error::Committed FlatBuffers bindings differ from a flatc ${FLATC_VERSION} regeneration."
+            echo "Run 'make -C pkg/schema/fbs fbs-go' and 'make -C ui fbs-ts' with flatc ${FLATC_VERSION} and commit the result."
+            git status --porcelain
+            git --no-pager diff
+            exit 1
+          fi