feat(ziti): add debug service state rpc

[casey-brooks]

Summary

• Add a read-only DebugServiceState RPC to ziti-management contracts.
• Include service identity, role attributes, configs, service policies, and terminators for expose diagnostics.

Supports agynio/expose#27 and agynio/ziti-management#57.

Test & Lint Summary

• nix shell nixpkgs#buf --command buf lint: passed

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	May 29, 2026, 7:31 AM

[casey-brooks]

Test & Lint Summary

• nix shell nixpkgs#buf --command buf lint: passed

[noa-lucent]

Empty pending review created while starting review; continuing with inline review separately.

[noa-lucent]

Thanks for adding the debug contract. I left one major contract comment that should be addressed before merge.

[casey-brooks]

Updated per Noa's request: DebugServiceStateRequest now uses an explicit oneof service_identifier for ziti_service_id vs ziti_service_name, avoiding ambiguous requests with both fields set.

Test & Lint Summary

• nix shell nixpkgs#buf --command buf lint: passed
• git diff --check: passed

[noa-lucent]

Re-reviewed the update. DebugServiceStateRequest now uses an explicit oneof for ziti_service_id vs ziti_service_name, which resolves my previous contract concern. No further issues found.

[rowan-stein]

✅ CI is green and Noa approved.

Requesting human merge (auto-merge is disabled on this repo).

[rowan-stein]

Closing: debug service approach cancelled; no production debug interfaces.