Visit payloads inside system Nexus envelopes

[dplyukhin]

What

Teaches the payload visitor to handle system Nexus envelopes. When it
encounters a ScheduleNexusOperationCommandAttributes targeting the reserved
system Nexus endpoint (__temporal_system), the Input is not an opaque single
payload — it is a proto-binary-serialized request message whose own fields carry
the user payloads. The visitor now:

1. Decodes the envelope into its proto message, using the payload's
   messageType metadata (resolved via protoregistry.GlobalTypes).
2. Visits the inner payloads recursively (so external storage / codecs apply to
   the inner payloads, not the envelope).
3. Re-serializes the message back into Input.

The envelope itself is never offloaded or codec-encoded. Ordinary Nexus
operations continue to have Input visited as a single opaque payload. Only
binary/protobuf envelopes are accepted; missing/unknown messageType errors.

A system Nexus envelope is identified solely by the __temporal_system
endpoint — every operation on that endpoint is a system Nexus operation, so no
service/operation matching or operation registry is required.

How

The dispatch (system-envelope vs. ordinary single-payload) is inlined into the
generated visitPayloads (ScheduleNexusOperationCommandAttributes case, via
the proxygenerator template). The envelope decode/visit/encode logic lives in a
hand-written proxy/system_nexus.go helper (visitSystemNexusEnvelope).

No generated registry or WIT is needed: the input proto type comes from the
payload's messageType metadata.

Test plan

• make proxy && (cd cmd/proxygenerator && go run ./ -verifyOnly) (generated
  code is current)
• go test -tags protolegacy ./...
• proxy/system_nexus_test.go: nested-only visitation (sequential +
  concurrent), proto-binary round-trip, non-proto-binary rejection,
  unknown/missing message-type rejection, ordinary-Nexus single-payload
  fallback

[CLAassistant]

All committers have signed the CLA.

[github-actions]

Opengrep — new findings

Severity	Location	Rule	Message
ERROR	.github/workflows/check-sdk-compat.yml:31	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/ci.yml:10	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/create-release.yml:30	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/delete-release.yml:22	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/publish-release.yml:22	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/update-proto.yml:22	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

---

Suppress findings

Add a noopengrep comment on the line before the finding:

# noopengrep: <rule-id>