Added the Nexus front that hides the store behind one endpoint.

[moedash]

This PR adds the Nexus front, which puts a stream store behind one Temporal-authenticated endpoint, and the Nexus operation that consumes a stream through its notification channel.

What changed?

• temporalio/streams/providers/nexus.py has NexusStreams, the outside half of a provider over the endpoint. It also has TemporalStreamsHandler, which serves the endpoint by fronting a storage provider's handles.
• temporal_streams.nexusrpc.yaml is the contract. An append carries serialized StreamRecord protos and the producer's batch index. A read long-polls, honors last_n, and says when the store ended it. scripts/gen_streams_nexus_api.py generates _nexus_generated/ with stock nexgen and refuses any version but the pin. Regeneration is idempotent, and check-protos guards drift.
• Both operations address a stream by a StreamRef. Its optional members are nullable on the wire. The handler maps the ref onto the store's accessor and refuses an owner the store can't host with StreamUnsupportedError.
• On the caller side, client.get_stream_handle(ref) opens a ref through the front, and NexusStreamHandle.ref() hands one back. So an operation can return a stream as data.
• The caller applies the codec before bytes leave the process. It commits a batch index only after the endpoint answers. A failure reaches it as the store's StreamError or an RPCError.
• The handler holds one batch and one read at a time per address, in weakly held lock maps. A parked read is released after subscription_idle, a minute by default.
• stream_consumer_operation(consume, initial=..., listener_url=...) builds StreamConsumerOperation, an asynchronous operation handler whose input is a StreamRef. On start it registers a callback listener on the stream's channel with the operation token in a header and reads the stream from its start through the client's provider. Each delivery the server posts leads to one read from the cursor to the head, a delivery with nothing new reads nothing, and the close (closed in the notification's metadata, a FINISH record, or the store ending the read) completes the operation through the caller's completion callback with the folded value. Cancel unregisters and reports canceled. The cursor lives in the process, keyed by the token.
• nexus_consumer_service.py is the standalone handler for the demo: an aiohttp process that serves Nexus start and cancel over HTTP for a nexusrpc handler, plus the /deliveries route the channel posts to. One command runs it and can register an external endpoint pointing at itself.
• The default channel_for is temporalio.client.stream_channel, the server's names for native streams (stream/<stream id> independent, stream/<topic> linked to the owning workflow or standalone activity, stream/<activity id>/<topic> for a workflow activity's). A rule answers with a ChannelAddress or a (channel, Execution | None) pair, and the registration and unregistration carry the owner of a linked channel as its execution. A store with its own rule passes channel_for.

Part of AI-198 (epic AI-37).

Why?

Producers and consumers should talk to one endpoint while the store behind it swaps by operator action. The IDL is how this surface reaches other SDK languages, since a client generated from the same file speaks the same wire. The ref on the contract is the spec's Nexus decision 1, option (b). The consumer operation is option 2 of the Nexus question: the operation registers as the stream's consumer and the server tells it, so the Nexus design and the channel design share one delivery path instead of the handler polling the front.

How did you test it?

I ran uv run poe lint and uv run pytest tests/streams. The live lane sets STREAMS_LIVE=nexus, TEMPORAL_ADDRESS and TEMPORAL_HTTP, then runs tests/streams/test_nexus_provider.py through the HTTP ingress of a server built from the series. The tests register and delete their own endpoint. They cover cursor resume across the hop, ciphertext at rest with a no-codec control read, and an operation that returns a StreamRef the client then reads.

tests/streams/test_nexus_consumer.py drives the consumer's state machine with a client stand-in over the memory store: the registration and the first read, deliveries read from the cursor once and in order, a folded burst costs one read, a delivery with nothing new is a no-op, the close and a FINISH complete through the callback with the right headers, cancel unregisters, an unknown token is ignored, a consume failure fails the operation and a read failure leaves it for the retry. The standalone service is checked against the Nexus HTTP protocol with aiohttp's test client. The live cases run with -E host:port against a server with channels and TEMPORAL_HTTP for its ingress: a caller workflow starts the operation on an external endpoint, the producer appends to the memory store behind the front and notifies the stream's channel by hand (this layer carries no store that notifies on its own), records before and after the registration are consumed once and in order, the close completes the workflow with the values, and the listener is gone from describe_channel after completion and after a cancel. The worker-hosted variant is tried once: the frontend accepts the channel's post as a start of a companion operation, and the completion is left as a follow-up because a worker's start context names temporal://system as the callback. A native case waits behind needs_stream_channel_server for a server whose streams notify their own channel.

• Unit Tests
• Staging
• End to End Tests

[moedash]

Replaced by #19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #30, #31, #32, #33, #34, #35, #36, #37, #38, #39, #40, #41, #42, #43, #44, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54 and #55.

Same content, split into 37 PRs in the v3 series: the notification channel first, then the streaming interface, then native streams and the rest. The branch stays as a pin.