Allow protobuf 7

[tconley1428]

What changed

• Relax the runtime protobuf and types-protobuf upper bounds to allow protobuf 7.
• Accept protobuf 7 in the default test environment guard.
• Relax googleapis-common-protos in the dev group to a protobuf-7-compatible range.
• Keep proto generation on the existing protobuf 3 toolchain by explicitly downgrading googleapis-common-protos in the proto-generation Docker/CI path before adding protobuf<4.
• Add a changelog note.
• Update descriptor-reflection helpers for protobuf 7 type stubs while keeping protobuf 3 runtime compatibility by falling back from is_repeated to label == LABEL_REPEATED.

Closes #1579.

Validation

• poe lint
• uv lock --check
• git diff --check
• docker build -q -f scripts/_proto/Dockerfile .
• Locked pre-7 protobuf environment: protobuf 6.33.6, focused tests pass:
  • uv run -m pytest tests/test_converter.py tests/test_service.py tests/api/test_grpc_stub.py tests/nexus/test_temporal_system_nexus.py tests/worker/test_command_aware_visitor.py -q
• Protobuf 7.35.0 local validation in a throwaway venv with grpcio/grpcio-tools 1.82.0rc1:
  • uv pip check --python /private/tmp/sdk-python-rc-min-venv/bin/python
  • python -m pytest tests/test_converter.py tests/test_service.py tests/api/test_grpc_stub.py -q
  • generated *_pb2.py import sweep had no protobuf-specific failures; the same three missing-module imports exist under protobuf 6.
• Pre-7 types-protobuf check: types-protobuf==6.32.1.20260221 exposes FieldDescriptor.is_repeated; mypy and basedpyright pass with those stubs.

Note: some optional extras can still force protobuf <7 through their own dependencies, e.g. google-adk via google-cloud-aiplatform. This PR allows protobuf 7 where the dependency graph permits it.