[PureGo] Add ingestion core: buffer, encoder, ack model, and supervisor

[zlata-stefanovic-db]

Summary

Fourth in the pure-Go SDK stack. Stacked on #496 (base branch purego-oauth-provider), though it can also target main once #495/#496 merge.

Adds internal/stream — the generic protocol-agnostic ingestion core that sits between the auth and transport layers and the (not yet built) public API:

• buffer.go — bounded, offset-assigning queue with semaphore-based backpressure. enqueue and next are both context.Context-cancellable: enqueue blocks until a slot opens (or ctx fires); next blocks until an item is queued (or its per-stream context fires), so each runOnce can stop its sender goroutine cleanly without cancelling the supervisor's outer context. requeue moves all in-flight items back to the front of the queue so recovery re-sends them in order. A doneCh unblocks callers parked on the semaphore when the buffer is closed or drained, so a blocked Ingest returns instead of hanging forever.

• encoder.go — encoder interface plus four implementations: protoEncoder, jsonEncoder, protoBatchEncoder, jsonBatchEncoder. Encoding is eager at Ingest time so the buffer holds []byte, never live user objects. Matches the Rust SDK's pattern (LandingZone holds already-encoded batches).

• ackmodel.go — ackModel interface plus offsetAckModel for proto/JSON (DurabilityAckUpToOffset maps directly to the logical offset). Arrow's record-count ack model slots in here without touching the core.

• core.go — three goroutines (sender, receiver, supervisor), monotonic ack watermark, Flush/WaitForOffset/Close/GetUnacked. The sender uses a per-runOnce derived context so a stream teardown unblocks buf.next() without cancelling the supervisor context (which would signal Close). Offset assignment is serialized with enqueue under ingestMu so nextOffset only advances for records that actually make it into the buffer — a failed Ingest (encode error or ctx-cancelled backpressure) no longer consumes an offset that Flush would wait on forever. Flush targets the highest successfully-enqueued offset, not nextOffset-1. Ingest on a cleanly closed stream now returns an error instead of (0, nil).

• supervisor.go — create → run → recover loop. Server-side EOF is treated as a retryable disconnect. Defaults match the Rust SDK: RecoveryRetries=4, RecoveryBackoff=2s, FlushTimeout=5m, LackOfAckTimeout=60s. On terminal failure it drains the buffer and fires OnError per unacked item when an AckCallback is registered; otherwise it closes the buffer and leaves items retrievable via GetUnacked (the two are mutually exclusive).

Also adds transport.StreamRPC (exported interface) and transport.NewStreamFromRPC so stream-package tests can inject in-process fake RPCs without a live gRPC server.

Stack

1. [PureGo] Add gRPC transport and stream layer #463 — gRPC transport + stream plumbing
2. [PureGo] Add GracefulClose to transport Stream #489 — GracefulClose
3. [PureGo] Add custom auth-header hook to transport #494 — auth header hook on transport
4. [PureGo] Add auth provider interfaces and per-table token cache #495 — auth HeadersProvider + token cache
5. [PureGo] Add UC OAuth token provider with per-table caching #496 — UC OAuth provider
6. this PR — ingestion core

Test plan

• go build ./... and go test ./internal/... -race pass (94 tests, 34 in internal/stream).
• Recovery test (TestCoreStreamRecoveryRequeuesUnacked) verifies items in flight when a stream dies are re-sent on the recovery stream and acknowledged correctly.
• Added regression tests: Ingest on a closed stream errors, a failed Ingest doesn't advance the Flush target (no permanent gap), and a Close unblocks an Ingest parked at capacity.

What's not yet here

• Public zerobus package (SDK builder, Stream interface, typed ingest methods)
• Arrow/Flight wire path and record-count ack model