Enforce service-bound Nexus clients during operation execution

[vikstrous]

Motivation

• Prevent operations from being executed with a Nexus client that was created for a different Service, which can cause routing and authorization mistakes.
• Fail fast with clear diagnostics including operation and service names to make routing errors straightforward to debug.

Description

• Extended NexusClient to carry the originating service identity via a new serviceName field and updated (*Service).NewClient to populate it.
• Added a shared validation helper validateServiceMatch(opName string, opService *Service, c *NexusClient) error that checks for a nil client and enforces that c.serviceName matches op.service.
• Invoked the validation from both SyncOperation.Execute and AsyncOperation.Execute, and chose to panic with an explicit message when validation fails because Execute returns a workflow.NexusOperationFuture and cannot return an error.
• Added tests in nexus_test.go (TestOperationExecutePanicsOnMismatchedClientService) that cover mismatched-client usage for sync and async operations, overlapping operation names, and a nil-client case, and included error messages with operation and service names.

Testing

• Ran go test ./... and all tests passed.
• New test TestOperationExecutePanicsOnMismatchedClientService verifies sync/async mismatched-client panics and nil-client panic and succeeded.

---

Codex Task