refactor(protocol): separate recognized and implemented capabilities

[SunSi12138]

Fixes #401
Refs #397

Summary

This PR is based on dev.

dev already contained the central ProtocolV2Negotiator, immutable NegotiatedSessionOptions, and RpcSession.TryCompleteHandshake(...) publication boundary. The remaining issue #401 authority leak was narrower: endpoint implementation/advertisement was derived from the protocol-recognition set.

This change:

• renames the protocol safety set from KnownCapabilities to RecognizedCapabilities
• makes ProtocolV2Negotiator.AlwaysImplementedCapabilities an explicit declaration rather than deriving it from RecognizedCapabilities
• keeps Compression conditional on configured provider bindings
• preserves unknown optional peer-bit forward compatibility and existing negotiated-response validation
• documents protocol recognition vs endpoint implementation/advertisement as separate facts
• adds regression coverage so adding a recognized bit cannot silently make endpoints advertise it

Minor/version audit on dev

Current dev has MinorVersion == 5 and MinimumCompatibleMinorVersion == 5; minors 0–4 are outside the current wire generation. No mixed-minor capability-history table is introduced.

location	purpose	classification
ProtocolV2Constants / handshake fields	wire grammar generation	protocol boundary
ProtocolV2Negotiator	compatibility validation and immutable negotiated options	negotiation boundary
RpcSession.TryCompleteHandshake	final publication safety check	handshake publication boundary
ProtocolV2PayloadCodec	serialize/parse minor	codec boundary
request/stream/cancel/compression runtime paths	no protocol-minor feature gates found	negotiated capabilities remain sole feature authority

Capability authority split

• RpcSessionProtocolRules.RecognizedCapabilities: bits understood by protocol/codec/session validation
• ProtocolV2Negotiator.AlwaysImplementedCapabilities: capabilities explicitly implemented unconditionally by the endpoint
• Compression: appended only when local provider bindings exist
• NegotiatedSessionOptions.Capabilities: sole optional-feature authority after successful handshake

Adding a future bit to RecognizedCapabilities alone therefore cannot make Client/Server advertise it.

Validation

Staging validation on dev@bb717ae:

• protocol minor/version usage audit — passed
• diff/whitespace and no-KnownCapabilities guard — passed
• complete SharpLink.UnitTests suite — passed

Formal PR CI on head 91a6a7a401ebe9e69926c3b90cec437011809727:

• PR Fast perf(server): avoid stream callback allocation for calls without input streams #678 — passed: project-reference boundary guard, formatting, maintainability gates, Release build, generated-assembly dependency guard, Unit/Generator/LoadTest tests
• CodeQL #3019 — passed
• PR Extended build(deps): bump github/codeql-action/init from 4.37.3 to 4.37.4 #49 — passed: Debug build + rollback test, Release prerequisite, Integration Tests, NativeAOT transport/topology smoke, pack/package contracts/package smoke, Oneway demo and load smoke
• Codec compatibility under PR Extended build(deps): bump github/codeql-action/init from 4.37.3 to 4.37.4 #49 — passed: six desktop producers and six cross-platform verification consumers across Linux/macOS/Windows x64+arm64, plus compatibility summary; browser evidence was intentionally disabled by the PR Extended caller

Temporary staging workflows/scripts were never present in the PR branch, and all temporary issue-401 staging branches were deleted after validation.

The PR was merged into dev at 2026-09-04 14:04:33Z; GitHub records merged_by: SunSi12138. Extended validation completed successfully on the same head/tree.

[SunSi12138]

Overall direction looks sound, and the minor-to-capability history matches the commits that introduced minors 1/2/3. I left two non-blocking engineering comments: one about separating protocol-known capabilities from endpoint-advertised support, and one about making the mixed-minor test scope explicit so it is not mistaken for historical wire-interoperability coverage.