[TheGreatAxios]

Part of CL-11525
Closes CL-11535

Why
Every pull request now runs through a host's listener and the managers it deploys, so the old pr-triage, pr-workflow and standalone code review workflows, and the tarball path that deployed them, are never used. This removes them, and the code that only existed to carry judge answers from one pr-triage run to the next.

What changed

• Workflow packages:
  • Deleted the pr-triage-github, pr-triage-bitbucket-datacenter and pr-triage-historical entries, the standalone pr-code-review-github and pr-code-review-bitbucket-datacenter entries, and the whole pr-workflow-anthropic package.
  • pr-triage stays as a local definition: the policy check action, the evals, the extension and the tests run it. The pr-code-review-reviewer-* workflows and triage-judge are unchanged.
  • Removed the contracts' decide(), which only the PR workflow ran.
• Judge answers are no longer carried between runs. Removed the mail's judged input, the carried-answer lookup, reusable, MAX_JUDGED_BYTES, Judged and judgeKey.
  • The verdict question is still asked in the first round when no judged rule comes before it, and in the second round otherwise.
• Tarball pipeline (CL-11535):
  • Deleted the hub's POST /api/integrations/workflow-deploy route and its OpenAPI entry, the package-registry asset it used, and the native-module fetch and packages/index.json in the portal build.
  • The build now writes only the manager chain's source trees. The e2e/workflow-registry.ts check and install-from-registry.ts went with it.
• Hub:
  • Removed TRIAGE_WORKFLOWS, CODE_REVIEW_WORKFLOWS, triageWorkflowOf, entrySource, PR_WORKFLOW_VARIANTS, the worker marker and worker kind, and sameSource. The reconcilers now run per host.
  • The audit log still shows old entries. It keeps the rotation reason as a plain string and reads old approval runs by the old workflow names.
  • Old audit entries keep naming the workflow that wrote them; they are not rewritten.
  • New webhook credentials name the host's listener. Stored ones are unchanged, since the name is only logged.
  • Removed PrTriageRow.workflowVersion; a stored row that still has one loads without it. Removed createVerdictRecordStore().record; tests seed rows through replaceVerdict.
• REPLACED in apps/web/src/lib/triage-upgrade.ts stays, so Upgrade still cancels any old deployment that is live. A follow-up removes it once nothing old can still be running.
• tarballFilename moved from the contracts into tooling/pack-tarball.ts, its only user, and triage-workflows no longer declares an Interchange workflow entry.
• triage-runs.ts stays: held Dos and the audit log still read a run's verdict and approval from it.
• Docs: ARCHITECTURE (Workflows; the PR workflow section is now a short Policy blocks section), IMPLEMENTATION, DECISION_MODEL, BITBUCKET_DATACENTER, DEV, and the package READMEs.

Verified

• bun run check clean. bun run lint has no new warnings; the one in manifest.test.ts is an existing line this PR does not touch.
• Policy check against origin/main: everything that runs locally passes except max-files-changed, because the PR deletes whole packages (94 files, max 30).
• Triage-workflows no-model eval (eval:hidden-content): 187/187 before, 187/187 after.
• bun run test: 1356 pass, 2 fail. Both came from one hook timeout in apps/hub/src/server.test.ts while the machine was under heavy load; the file passes 11/11 on its own.
• bun run test:chain: 7/7.
• The contracts tests are not type-checked by bun run check: no tsconfig covers them, and adding one surfaces 27 existing type errors across eight test files, so that is left for its own change.

[linear-code]

CL-11525

CL-11535