just setup does not install protoc, so the documented setup path leaves the workspace unbuildable

A new contributor who follows the documented setup cannot build the workspace. `just setup` reports success, then the first `just check` dies in a build script several minutes later. The missing piece is `protoc`, which is the one required tool that is not a cargo install, and so is the one tool the setup script does not handle.

**Expected.** `just setup` runs `scripts/dev-setup.sh`, described in its own header as "install and configure the Prism development toolchain", and CLAUDE.md lists it as "install all dev toolchain extensions". CI treats protoc as a prerequisite and installs it in four separate jobs, so the dependency is well understood; it just is not reflected on the local path.

**Actual.** `scripts/dev-setup.sh` installs nine cargo tools and never mentions protoc. Nothing in the Justfile, `docs/dev-setup.md`, `README.md`, or `CONTRIBUTING.md` mentions it either.

## Repro

On a machine without protoc, after a successful `just setup`:

cargo build -p prism-ocsf

```
error: failed to run custom build command for `prism-ocsf v0.1.0`

Caused by:
process didn't exit successfully: build-script-build (exit status: 101)
--- stderr
thread 'main' panicked at crates/prism-ocsf/build.rs:68:10:
build.rs: prost-build failed to compile OCSF .proto files: Custom { kind: NotFound,
error: "Could not find `protoc`. If `protoc` is installed, try setting the `PROTOC`
environment variable to the path of the `protoc` binary. To install it on macOS, run
`brew install protobuf`. ..." }
```

```
$ command -v protoc
$
```

The prost-build message itself is good and actionable, so this is not about the diagnostic. It is that the documented setup path does not get you there, and the failure surfaces only after a full dependency build.

## Mechanism

`crates/prism-ocsf/build.rs` invokes prost-build to compile the bundled OCSF schema, which shells out to `protoc`. `prism-ocsf` sits early in the workspace dependency graph, so its build-script failure aborts the whole command: `cargo clippy --workspace` reports one error and lints nothing. That makes the missing tool disproportionately expensive, since it blocks commands that have nothing to do with OCSF.

`scripts/dev-setup.sh` is built around `install_if_missing`, which is a thin wrapper over `cargo install --locked`. protoc has no cargo package, which is likely why it was never added.

Relevant paths: `scripts/dev-setup.sh:14-40`, `crates/prism-ocsf/build.rs:68`, `.github/workflows/ci.yml:35`, `Justfile` `setup` recipe.

## Ask

Could `scripts/dev-setup.sh` install protoc alongside the cargo tools, and check for it up front so the failure is immediate rather than several minutes into a build? Happy to follow up with a PR.

The issue is in `scripts/dev-setup.sh`. First, read that script to understand the `install_if_missing` pattern. Then, add a check for the `protoc` binary, and if missing, install it via the appropriate package manager (e.g., `brew install protobuf` on macOS). Update the `Justfile` `setup` recipe if needed. Test by running `just setup` on a clean environment and verifying `protoc` is present and `cargo build -p prism-ocsf` succeeds.

Written by the indexing model from the issue text.