feat: define experimental runtime protocol - #186

Review: approved ✅

+621/-0, new isolated package, zero changes to existing code paths — about as low-risk as a foundational PR gets.

What I checked

• Dependency-free and transport-neutral. @deepcode/protocol pulls nothing in, which is what lets it be imported by the renderer, the VS Code extension host, the LSP process, and the app-server without dragging Node or provider code into browser bundles. That constraint is load-bearing for feat: move desktop runtime behind app server #192's "no provider code in the renderer" goal — please keep it dependency-free.
• Persist completed items, keep streaming deltas transient. Right call: replaying a thread should reconstruct meaning, not re-simulate typing. It also bounds durable storage growth, which token-by-token persistence would not.
• One active turn + idempotent terminal transitions, enforced in the protocol layer rather than by convention in each client. Idempotent terminals in particular mean a duplicate interrupt or a reconnect racing a completion can't corrupt thread state.
• 161 lines of tests for 217 lines of state machine, covering the transition rules rather than just the happy path.

Version negotiation and record/replay semantics being documented up front (docs/design/runtime-protocol-v1.md) is what will make the later capability-gated additions (#190, #197, #203, #205) additive rather than breaking.

Validation: CI green; protocol package 24 tests pass locally at the stack tip.