Interface request/response messages share a global namespace (collision risk)

[freol35241]

Problem

interfaces/*.proto are package-less and compiled in a single protoc pass, so every RPC request/response message lives in one global namespace. Two interfaces defining a same-named wrapper (StartResponse, Ack, …) collide, and any wrapper is implicitly referenceable from any other interface — there is no per-interface scoping boundary.

Surfaced while adding SimulationControl + VehicleSimulatorControl: an empty ack initially had to be hand-shared across both files, and generic names like StartResponse/StopResponse are exactly the kind that will clash as the interface surface grows.

Relation to #153

#153 carves out RPC wrappers as a distinct bucket ("RPC-only, never published") but tackles the domain-type sharing problem — not the wrapper namespace problem. This is the complementary half: even purely RPC-only wrappers need a collision boundary. Both trace to the same root cause — interfaces being package-less.

Potential resolution

Give each interface (or the interface set) its own protobuf package (e.g. package keelson.simulation;), so wrappers are namespaced (keelson.simulation.StartResponse) and cannot collide across interfaces.

Verified safe in the current SDK: interface response types are resolved by importing the generated class directly — nothing keys on proto full_name (the JS typeRegistry is payloads-only), so adding a package changes only DESCRIPTOR.full_name, not import paths or wire format.

Could land alongside the namespacing step already proposed in #153 (moving shared domain types into package keelson).