refactor(protos): move compat manifest send-site assertions into owning crates (#6618)

refactor(protos): move internode compat manifest send-site assertions into owning crates

Promotes the rolling-upgrade dual-write manifest from a test-only constant in rustfs-protos into the public rustfs_protos::compat_manifest module, moves the JSON-encoder send-site assertions into the crates that own the asserted sources (ecstore remote_disk.rs for requests, the rustfs binary node_service/disk.rs for responses), and splits the scanner Phase-0 overlap inventory so its heal- and ecstore-owned halves live in those crates. Adds a cross-crate include_str!/include! guard with fixture self-tests to scripts/check_layer_dependencies.sh so a library crate can never again read another crate's Rust source at compile time, and records the rule in docs/architecture/crate-boundaries.md.

Part of rustfs/backlog#1884.

crates/ecstore/src/cluster/rpc/remote_disk.rs

@@ -3885,6 +3885,27 @@ mod tests {
 
     static INIT: Once = Once::new();
 
+    #[test]
+    fn request_compat_send_sites_keep_manifest_json_encoders() {
+        // Rolling-upgrade contract (rustfs-protos compat manifest): every
+        // dual-write request field must keep producing its JSON side with the
+        // exact encoder the manifest pins, until the msgpack-only switch (and
+        // fallback-zero confirmation) retires it. The manifest itself is
+        // pinned against node.proto by tests in rustfs-protos; this test keeps
+        // the send-site assertion in the crate that owns the source file.
+        let source = rustfs_protos::compat_manifest::production_source(include_str!("remote_disk.rs"), "remote_disk.rs");
+
+        for send_site in rustfs_protos::compat_manifest::REQUEST_COMPAT_SEND_SITES {
+            assert!(
+                source.contains(send_site.json_encoder),
+                "{}.{} must keep its manifest encoder: {}",
+                send_site.field.message,
+                send_site.field.json_field,
+                send_site.json_encoder
+            );
+        }
+    }
+
     #[test]
     fn delete_versions_response_preserves_typed_item_errors() {
         let errors = decode_delete_versions_errors(

crates/ecstore/tests/scanner_heal_admission_contract_test.rs

@@ -0,0 +1,29 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! ECStore-owned half of the scanner/heal overlap Phase-0 inventory (formerly
+//! a cross-crate source include in crates/scanner). The assertions
+//! deliberately check that the documented write-exclusion guards still exist;
+//! they do not claim that a shared admission primitive already exists.
+
+const HEAL_OBJECT_SOURCE: &str = include_str!("../src/set_disk/ops/heal.rs");
+const SET_LOCKING_SOURCE: &str = include_str!("../src/set_disk/ops/locking.rs");
+
+#[test]
+fn set_disk_overlap_inventory_keeps_write_exclusion_guards() {
+    assert!(HEAL_OBJECT_SOURCE.contains("heal_object"));
+    assert!(HEAL_OBJECT_SOURCE.contains("get_write_lock"));
+    assert!(SET_LOCKING_SOURCE.contains("scanning_disks"));
+    assert!(SET_LOCKING_SOURCE.contains("new_disks.extend(scanning_disks)"));
+}