Centralize NATS stream and subject naming in proto

[haasonsaas]

Context

Each service hardcodes NATS stream and subject names in config defaults (e.g., audit: AUDIT_APPROVALS_EVENTS_STREAM="approvals_events"). There is no schema registry or canonical list of NATS subjects. This creates coordination risk when a publisher renames a subject — consumers silently stop receiving events.

Requirements

• Define a proto/events/v1/subjects.proto with string constants for all NATS subjects used across the platform
• Group by domain: evalops.events.audit.*, evalops.events.approvals.*, evalops.events.pipeline.*, etc.
• Include stream configuration (name, retention policy, max age) as proto constants or comments
• Document the subject naming convention for new services
• Add a CI check that verifies services reference proto-defined subjects (not hardcoded strings)

Currently used subjects (partial inventory)

• approvals_events (audit consumes)
• audit.events.* (compliance consumes)
• identity.events.agent.* (registry bridge consumes)
• pipeline.tap.* (pipeline tap-consumer)
• pipeline.cerebro.* (pipeline cerebro-consumer)
• notifications.* (notifications consumer)
• objectives.* (various)

Why this matters

NATS is the primary inter-service communication bus. Without a centralized schema, adding a new consumer for an existing event stream requires reading the publisher's source code to discover the subject name. This doesn't scale with 20+ services.