fix: close round-2 strict-proto config-field gaps (v0.2.3)

[intel352]

Summary

BMW local smoke against workflow-server v0.51.5 surfaced two gaps the v0.2.2 sweep missed:

• step.auth_challenge_generate — replaced EmptyConfig with new AuthChallengeGenerateConfig { signing_secret, ttl_minutes }. BMW passes both fields in the step's config: block; strict-proto was rejecting them under the EmptyConfig contract. Handler now falls back to config.signing_secret and config.ttl_minutes when input lacks them.
• AuthPolicyGateConfig — confirmed all four BMW-supplied fields (policy_step, signing_secret, tenant_id, required_runtime_keys) are present and accepted. Added TestAuthPolicyGateConfig_AcceptsAllBMWFields as exhaustive regression guard.

Also updated .github/fixtures/workflow-compat.yaml to exercise the new challenge_generate config fields and the existing policy_gate tenant_id field in the daily compat job.

Files changed

• internal/contracts/auth.proto — new AuthChallengeGenerateConfig message
• internal/contracts/auth.pb.go — regenerated (protoc-gen-go v1.36.11)
• plugin.contracts.json — step.auth_challenge_generate config → AuthChallengeGenerateConfig
• internal/plugin.go — runtime contract registry + CreateTypedStep factory wiring
• internal/step_challenge.go — handler accepts config, falls back for signing_secret + ttl_minutes
• internal/plugin_contracts_test.go — updated assertion for new config message
• internal/strict_proto_fields_test.go — 4 new tests (AllBMWFields, AcceptsSigningSecretAndTTL, FallsBackToConfigSigningSecret, FallsBackToConfigTTL)
• .github/fixtures/workflow-compat.yaml — exercise new config fields
• CHANGELOG.md — v0.2.3 entry
• plugin.json — version bump 0.2.2 → 0.2.3

Test plan

• go test ./... passes (all tests including 4 new ones)
• go vet ./... clean
• go build ./... clean
• workflow-compat.yml CI green against latest wfctl
• BMW smoke re-run against v0.2.3 with workflow v0.51.5

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com