Add risk-based compatibility validation for dependency minor updates

## Context

The protobufjs 7.5.6 to 7.6.0 minor update changed how the `long` package is discovered. In the bundled worker, that changed decoded protobuf 64-bit values from JavaScript numbers to Long-like objects and caused the regression tracked by #844 and fixed by #845.

The package update was semver-minor, but it affected a public runtime contract through dependency resolution, bundling, and default deserialization behavior. Existing unit tests did not compare the observable contract before and after the dependency update.

## Proposal

Adopt risk-based compatibility validation for dependency updates. This should not require exhaustive functional comparison for every minor update. It should apply when a dependency can affect:

- wire protocols or serialization/deserialization
- public JavaScript value types or object shapes
- generated code or reflection descriptors
- bundler/module-resolution behavior
- runtime loading, worker startup, or host/worker contracts

For those updates:

1. Review the published package diff, release notes, and transitive dependency changes.
2. Identify observable worker contracts owned by the dependency.
3. Compare the old and new versions using the same production inputs and production configuration.
4. Exercise the production bundle when module discovery or bundling can affect behavior.
5. Add regression tests or explicit configuration for defaults that must remain stable.
6. Record intentional output differences in the dependency update PR.

Add this guidance to the repository's future `AGENTS.md` and/or `architecture.md`, together with a dependency-update checklist.

## Suggested protobuf coverage

- Load and resolve the production Functions RPC descriptor.
- Compare package definitions and service/method contracts.
- Round-trip representative RPC messages.
- Assert the JavaScript shape of all protobuf 64-bit scalar, repeated, and map variants used by the worker.
- Build the production webpack bundle and run the contract check against it.

## Acceptance criteria

- [ ] Repository guidance defines which dependency updates require compatibility comparison.
- [ ] The dependency-update checklist covers published diffs, transitive dependencies, production configuration, and bundle behavior.
- [ ] High-risk dependency PRs include before/after contract evidence or explain why it is not applicable.
- [ ] Protobuf contract tests protect stable 64-bit value shapes and production descriptor loading.

## Related

- #844
- #845

Start by reviewing the regression context in #844 and #845, then inspect the repository's AGENTS.md and/or architecture.md guidance. Define the dependency-update checklist around published and transitive changes, production configuration, and bundle behavior; validate it with protobuf descriptor loading, representative RPC round trips, 64-bit value shapes, and the production webpack bundle. Done means the guidance and checklist exist and high-risk updates have contract evidence or an explicit exception.

Written by the indexing model from the issue text.