kill protobuf from default build: k8s engine behind -tags k8s, expand CI guard

engines/k8s/engine.go: //go:build k8s. k8s.io/client-go transitively
pulls google.golang.org/protobuf via k8s.io/kube-openapi → gnostic-models.
Opt-in build: go build -tags k8s ./... to enable Kubernetes deploy
support. Default builds skip the file entirely.

scripts/check-no-grpc.sh: extend the CI gate to fail on any of:
  - google.golang.org/grpc
  - grpc-ecosystem/grpc-gateway
  - google.golang.org/protobuf
  - go.opentelemetry.io/proto/otlp/*
  - k8s.io/client-go

Each has a documented -tags escape hatch. The default-tag dep graph
must be clean of all five.

Results:
  bash scripts/check-no-grpc.sh   → ok
  binary size:                    37.9 MB → 26.7 MB (-11.2 MB)
  strings grep protobuf|grpc      → 0 hits

Per the project rule: ZAP internal, ZIP edge. ZAP is now the only
wire protocol the default netrunner binary contains.

engines/k8s/engine.go

@@ -1,8 +1,16 @@
 // Copyright (C) 2025, Lux Industries Inc. All rights reserved.
 // SPDX-License-Identifier: BSD-3-Clause
 
+//go:build k8s
+
 // Package k8s provides a Kubernetes-based deployment engine for Lux networks.
 // It implements the Engine interface to deploy validator nodes as StatefulSets.
+//
+// Gated behind -tags k8s. k8s.io/client-go transitively imports
+// google.golang.org/protobuf via gnostic-models; the project rule
+// (ZAP internal, no proto on the wire) means we keep that out of the
+// default netrunner binary. Build with `go build -tags k8s ./...` when
+// you need Kubernetes deployment.
 package k8s
 
 import (

scripts/check-no-grpc.sh

@@ -1,9 +1,17 @@
 #!/usr/bin/env bash
-# Enforces the project rule: default-tag builds of netrunner have ZERO
-# google.golang.org/grpc and grpc-gateway transitive deps.
+# Enforces the project rule "ZAP internal, ZIP edge" — default-tag builds
+# of netrunner must have ZERO of:
+#
+#   * google.golang.org/grpc            (legacy RPC transport)
+#   * grpc-ecosystem/grpc-gateway       (HTTP→gRPC bridge)
+#   * google.golang.org/protobuf        (proto-on-the-wire substrate)
+#   * go.opentelemetry.io/proto/otlp/*  (OTLP=protobuf — gate behind -tags otlp)
+#   * k8s.io/client-go                  (gnostic-models pulls protobuf — gate behind -tags k8s)
+#
+# Each forbidden dep has a -tags escape hatch for legitimate opt-in use.
+# Default builds must never drag any of these in.
 #
 # Run from netrunner repo root:  bash scripts/check-no-grpc.sh
-#
 # CI gate. Fails non-zero with a tagged list of offenders.
 
 set -euo pipefail
@@ -11,15 +19,17 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 bad=$(go list -deps -f '{{.ImportPath}}' ./... 2>/dev/null \
-        | grep -E '^google\.golang\.org/grpc(/|$)|grpc-ecosystem/grpc-gateway' \
+        | grep -E '^google\.golang\.org/grpc(/|$)|grpc-ecosystem/grpc-gateway|^google\.golang\.org/protobuf(/|$)|^go\.opentelemetry\.io/proto/otlp|^k8s\.io/client-go(/|$)' \
         || true)
 
 if [[ -n "$bad" ]]; then
-  echo "ERROR: gRPC transitive deps leaked into default-tag build:" >&2
+  echo "ERROR: forbidden transitive deps leaked into default-tag build:" >&2
   echo "$bad" | sed 's/^/  - /' >&2
   echo "" >&2
-  echo "ZAP is the only wire protocol on default builds. gate via -tags grpc only." >&2
+  echo "ZAP is the only wire protocol on default builds." >&2
+  echo "Gate behind -tags grpc (legacy gRPC), -tags otlp (OTLP/protobuf trace export)," >&2
+  echo "or -tags k8s (k8s.io/client-go deploy engine) for opt-in use only." >&2
   exit 1
 fi
 
-echo "ok: no grpc/grpc-gateway in default-tag dep graph"
+echo "ok: no forbidden deps in default-tag dep graph (grpc/grpc-gateway/protobuf/otlp/k8s clean)"