feat: add hybrid workflow recipe catalogs

[leynier]

Summary

• Add explicit Built-in, Personal and Project recipe identities, with Quick Fix and Feature Delivery and embedded versioned role contracts.
• Compile bounded declarative YAML, validate references and stage DAGs, and read project catalogs through no-follow directory capabilities.
• Add durable Personal compare-and-swap editing, immutable-content snapshot validation and deferred local-only CLI/RPC catalog access. No workers or tasks start from catalog operations.

Validation

• Full make rust-test passed after all fixes, including 35 workflow tests and existing orchestration/host regressions. An earlier documented PTY flake passed isolated and on full reruns. Full Flutter analysis, 73 protocol/client/Board repository tests with coverage, and max-lines/whitespace checks passed; no Dart changes in the fix batches.
• Fixed review findings for private schema diagnostics, current-client notification delivery and JSON surrogate-pair interoperability, with regressions preserving bounds/duplicate-key rejection. Codex gpt-5.6-sol high review3 passed with no findings at 21a7ff95 against workflows/04-contracts (258d119d); reviewer independently passed 300 core and 9 CLI/catalog tests.
• Current-head PR Checks 33344507043, Mobile Builds 33344506978, Windows PTY 33344506975 and CodeQL 33344505063 passed, including pinned-v0.49 conformance and all 5 Windows process-job tests. Zero code-scanning alerts. An intermediate-head artifact timeout is historical, not used as passing evidence.

Notes

Layer 5 of 10; remains draft. No UI, Dart-generated or FRB API changes. Contracts travel with recipes; profile bindings and credentials do not. Personal saves preserve explicit revision checks; Project export/diff confirmation belongs to the catalog UI layer. Plan approval, human gate enforcement, isolated execution and integration remain separate layers. The final top-SHA desktop matrix is still required under the approved validation policy.