[interceptor]: Add payload codec interceptor and wire into the proxy

[pseudomuto]

The proxy forwarded WorkflowService traffic upstream with no hook to transform payloads in flight. This adds the machinery to run codec chains (compression, encryption, etc.) over payloads crossing the proxy.

The new internal/interceptor package provides Payloads, a gRPC unary client interceptor that encodes outbound request payloads through an ordered codec chain and decodes inbound responses in reverse, so one chain undoes its own transformations.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 89.39394% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.76%. Comparing base (9264c19) to head (eb3b483).

Files with missing lines	Patch %	Lines
internal/interceptor/fx.go	37.50%	4 Missing and 1 partial ⚠️
internal/interceptor/payload.go	95.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #60      +/-   ##
==========================================
+ Coverage   85.60%   85.76%   +0.16%     
==========================================
  Files          33       35       +2     
  Lines        1042     1103      +61     
==========================================
+ Hits          892      946      +54     
- Misses        128      133       +5     
- Partials       22       24       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR introduces an outbound gRPC client interception layer for the proxy so payloads can be transformed in-flight (e.g., compression/encryption) via an ordered codec chain, and wires this into the fx app and CLI serve path.

Changes:

• Extend internal/proxy.Server construction to accept and chain unary/stream client interceptors on the upstream connection.
• Add internal/interceptor package with a payload-transforming unary client interceptor (Payloads) plus an fx Module that contributes it to the proxy via value groups.
• Add/extend tests to validate interceptor chaining and payload codec ordering (encode forward / decode reverse).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/proxy/server.go	Adds outbound dial options to chain unary/stream client interceptors to the upstream connection.
internal/proxy/server_test.go	Adds coverage for interceptor options accumulating and chaining in order.
internal/proxy/fx.go	Adds fx value-group plumbing for interceptors and wires them into proxy construction.
internal/proxy/fx_test.go	Verifies fx wiring of interceptor groups and the new interceptor module.
internal/interceptor/payload.go	Implements the payload codec chain over outbound/inbound payload visitation.
internal/interceptor/payload_test.go	Tests correct encode/decode ordering and error propagation.
internal/interceptor/fx.go	Provides the payload interceptor into the proxy’s interceptor value groups.
internal/interceptor/fx_test.go	Validates the interceptor module contributes the expected unary interceptor.
internal/interceptor/doc.go	Adds package-level documentation for the interceptor package.
cmd/proxy/serve.go	Wires interceptor.Module into the CLI serve fx app.

[zdylag-temporal]

Is it worth explaining in the docstrings here why we want to implement our own compression/encryption as middleware rather than using default call options ala https://github.com/grpc/grpc-go/blob/master/Documentation/compression.md ?

[pseudomuto]

Is it worth explaining in the docstrings here why we want to implement our own compression/encryption as middleware rather than using default call options ala https://github.com/grpc/grpc-go/blob/master/Documentation/compression.md ?

Yeah, that makes sense. It'll likely come up again, so a quick note wouldn't hurt. I've added a docstring here. For reference here's the comment (so you don't have to search for it):

// These codecs transform the Temporal payloads carried inside WorkflowService
// messages, not the gRPC frames themselves. Unlike gRPC transport compression
// (grpc.UseCompressor), which a peer decodes on arrival, these transformations
// persist: the upstream server stores the encoded bytes. That is what enables
// at-rest compression and encryption, and lets an ordered chain express
// transforms (e.g. compress-then-encrypt) that fixed transport options cannot.