refactor(metadata-protocol): move the record reads out of protocol.ts into protocol-record-reads.ts

Move-only: the existence check, the OCC version checks, the read made as
the calling principal, the cross-object search and the write-response
strip move unedited into protocol-record-reads.ts (RecordReadHost); the
class keeps each method's name, docblock and signature. probeRecord and
getMetaItemCached stay. The row-serving door pin follows searchAll's
admission call and exposure decision to the new file.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8pUyVs5eas1AjMdReJM7C

Author: claude

packages/core/src/security/row-serving-door-exposure.pin.test.ts

@@ -77,11 +77,11 @@ type Classification =
 
 /** Every non-test caller of the read admission, classified. */
 const CALLERS: Record<string, Classification> = {
-  'packages/metadata-protocol/src/protocol.ts': {
+  'packages/metadata-protocol/src/protocol-record-reads.ts': {
     kind: 'door',
     door: 'the cross-object search (`GET /search`, `searchAll`)',
     operation: 'search',
-    decisionSite: 'packages/metadata-protocol/src/protocol.ts',
+    decisionSite: 'packages/metadata-protocol/src/protocol-record-reads.ts',
     pin: 'packages/metadata-protocol/src/protocol.search-api-exposure.test.ts',
   },
   'packages/services/service-analytics/src/plugin.ts': {