ci: install protoc 28.3 from GitHub (Ubuntu protoc too old for proto3 optional)

infra/docker/Dockerfile.ci-builder

@@ -10,8 +10,6 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
-    protobuf-compiler \
-    libprotobuf-dev \
     curl \
     ca-certificates \
     pkg-config \
@@ -22,8 +20,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     perl \
     build-essential \
     libfontconfig1-dev \
+    unzip \
     && rm -rf /var/lib/apt/lists/*
 
+# protoc 28.3 (proto3 optional support, matches local dev)
+RUN curl -fsSL https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protoc-28.3-linux-x86_64.zip -o /tmp/protoc.zip \
+    && unzip -o /tmp/protoc.zip -d /usr/local bin/protoc 'include/*' \
+    && rm /tmp/protoc.zip \
+    && chmod +x /usr/local/bin/protoc
+
 # Install Rust 1.89 stable
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.89.0
 ENV PATH="/root/.cargo/bin:${PATH}"