feat(sdk/go): add curated workspace service discovery snapshots and watches #4955

Related: #4667 (workspace discovery API), #4310 (service exposure). Dependency: #4941.

User Story

I use OpenShell sandbox services with an independently deployed Kubernetes ingress controller. I need a supported Go SDK discovery client so that the example controller can consume the same service discovery API as the sandbox proxy.

Problem Statement

Generated RPC bindings alone do not offer a curated Go snapshot/watch interface with domain types and documented stream lifecycle behavior.

Impact / Why This Matters

Each Go discovery consumer otherwise duplicates conversion, validation, and cancellation handling, making external infrastructure integrations harder to review and maintain.

Proposed Design

Expose explicit-workspace snapshots and watches through client.ServiceRoutes(), with domain types independent of protobuf packages, deep-copying converters, and explicit receive/close/error semantics. Keep reconnect policy in the consumer. The example Kubernetes HTTPRoute controller remains a separate proof of concept.

Suggested UX

snapshot, err := client.ServiceRoutes().Snapshot(ctx, workspace)
watch, err := client.ServiceRoutes().Watch(ctx, workspace)
// Receive complete replacement snapshots with watch.Recv(); close with watch.Close().

Acceptance Criteria

• Snapshot and watch are available through a narrow supported SDK interface.
• Requests require an explicit workspace and propagate caller cancellation.
• Domain types do not import generated protobuf packages.
• Converters deep-copy and validate complete responses.
• EOF, server errors, cancellation, and Close behavior are tested with bufconn.
• SDK API documentation and the Go CI pipeline cover the new interface.

Alternatives Considered

Consumers can use generated RPCs, but duplicating lifecycle/conversion behavior weakens the supported SDK boundary. A gateway compute driver would couple infrastructure reconciliation to the control plane; middleware and providers do not provide a discovery client API.