[SaladDay]

Moves the wire types and validators that internal/agentdaemon/proto borrowed from other packages into the protocol package.

• proto now owns SkillMetadata, PluginMetadata, CapabilitySources, InstalledSkill, PluginMCPServer, ValidateCapabilitySources and ValidateSourceDirectories (new capability_sources.go). It no longer imports agentcapabilities, agentskill or agentplugin, which keep only install, bundle and upload logic and use the proto types. JSON tags are moved verbatim, so field names are unchanged; the existing proto tests pass.
• runtimedevice.KindCapabilities and its explicit projection in runtimegateway are unchanged: the persisted boolean form is a legitimate projection of the wire tri-state type, and TestCapabilityProjectionCoversEveryField checks that they stay in step.
• docs/runtime-protocol.md (and zh) now describe the Subagent message families and the finite workspace read error codes.
• Wire change: read_unsupported is removed from Core's accepted rejected-read codes. Only the Harness-level read path in apps/daemon/internal/dispatch produced it, and that path is deleted by Remove Harness-level workspace reads #834, so this lands together with Remove Harness-level workspace reads #834. Proto itself never defined the code.

Checks: go vet for the root and services/core modules (and GOOS=windows for the daemon), tests for the touched root packages, daemon packages and Core packages, and the Core layering test. The translation hash check passes; the structure subtest of website/tests/translations.test.mjs could not run here because vitepress is not installed.