refactor(buddy): move protocol + docs governance commands out of userland into core

[glennmichael123]

Addresses @chrisbreuer's review: the protocol-conformance + docs-freshness tooling was added under app/Commands/{protocol,docs} (userland) in #2168, but these are core framework-repo commands, not app code. This moves them where they belong.

What moved

app/Commands/{protocol,docs,run-tool.ts,Protocol.ts,Docs.ts} → storage/framework/core/buddy/src/commands/ (27 files, history preserved via git mv).

• Protocol.ts/Docs.ts → named-export core registrars (export function protocol(buddy) / docs(buddy)), matching every other built-in command.
• 22 protocol:* / docs:* entries registered in the core lazy-command loader (lazy-commands.ts) + the commands barrel (index.ts).
• app/Commands.ts drops the protocol/docs registrations (keeps the inspire example - that one is a userland sample).
• The protocol suite + evidence DATA stays under .github/protocol/ (unchanged); only the tooling moved.

Fixes required by the move

• Repo-root path depth (import.meta.dir) + cross-package imports rewritten for the deeper location.
• CI workflow (ci.yml, desktop-lifecycle.yml) + generated-doc header paths updated.
• 6 latent strict-null type errors the looser app/ tsconfig had hidden (regex-group / buffer-index access under noUncheckedIndexedAccess) - fixed with proper guards so the tooling passes the strict framework typecheck.

Verified

• Framework typecheck: clean in all moved files (the only remaining errors are pre-existing local ts-cloud/stripe dep drift, which CI is green on).
• Lint: clean. Moved tests: 48/48 pass.
• ./buddy protocol:manifest:check and docs:* wire + run correctly end-to-end.

CI note

protocol-conformance stays red on the pre-existing #2179 governance-evidence drift (orphaned bf1245e source-manifest pin - git rev-parse on a GC'd commit), which fails on main independently of this move. Separately, I noticed docs:buddy:check bakes a machine-specific --project default path into the generated reference, so it can't match across machines - also a governance-evidence/generator issue for that same refresh, not this move.