tracing: add append-only proto encoding for v2 writers

Protozero backfills a nested message's four-byte length when the message
closes. That is illegal on the v2 ring, where the bytes in front of it
may already have been taken by the reader. This adds a second
nested-message framing that never writes a length ahead of its payload,
and the pass that turns it back into ordinary protobuf.

- The framing opens a nested field with varint((f << 3) | 3) and closes
  it with the bare byte 0x04. The terminator carries no field id, so
  this is not group encoding and a field-numbered end-group tag is
  rejected. A root emits neither wrapper nor terminator.
- protozero::NestedMessageEncoding is chosen once at Reset() and
  inherited by every child. The two-argument Reset() stays the default
  and stays out-of-line, so the exported symbol still resolves for
  anything already linked. A value outside the enum is rejected there.
- The C runtime emits the same bytes. struct PerfettoPbMsg keeps its
  public layout by putting the mode and finalized bits in the top two
  bits of `size`. They are set only in the new mode, so `size` on the
  existing path is what it always was, before and after Finalize().
- Both C ABI boundaries abort on an encoding they do not recognise
  rather than guessing v1 framing, and the legacy packet factory CHECKs
  that the root is length-delimited.
- RewriteToLengthDelimitedProto() converts a reassembled packet back,
  with bounds checks and a cleared output on every failure: these bytes
  become untrusted input once the consumer moves into traced.
- TraceWriterV2 gives protozero one fragment at a time. When a packet
  outgrows its chunk it publishes with "continues on next chunk",
  notifies the delegate, and only then asks for the next chunk; it also
  notifies when an acquisition burned positions. Both matter for a
  packet larger than the ring, where nothing else gives the reader a
  reason to run before the writer needs the capacity back.

Not wired up: no bridge, no muxer, no flag.

Tests: exact byte vectors for both modes in C++ and C, C/C++ parity, the
public struct's layout and raw `size` against a legacy mirror, a death
test for an unknown encoding, the rewriter's rejection cases, and
TraceWriterV2 through the ring and the rewriter - including a packet
several times larger than the whole ring and a stalling writer
recovering from chunks it could not claim.

Bug: 536851377