feat: add reviewed workflow plans and stage gates

[leynier]

Summary

• Add durable, bounded workflow plans with frozen recipe, contract, profile and source-workspace snapshots, idempotent preparation and traceable correction revisions.
• Require desktop-signed, revision/evidence/SHA-bound human decisions for plan approval and Foundation/Product gates. Keep shared-token and legacy dispatch paths blocked for workflows.
• Add deferred local RPCs, CLI preparation/inspection, additive desktop capability, aggregated Attention updates and native signing bindings. Execution stays fail-closed until the managed worktree and integration layers.

Validation

• Full make rust-test and the exact CI cargo test --workspace --locked command passed after fixing schema dependency ordering, including 315 core and 191 native tests. Added a deterministic regression for Board trigger installation and pooled SQLite connections.
• Full Flutter analysis and 90 focused Flutter tests with coverage passed, including four unchanged Run Board CI goldens and independent capability combinations.
• FRB bindings regenerated; max-lines, format, whitespace and actionlint passed.
• Codex gpt-5.6-sol high review2 passed without findings at 4961d59 against workflows/05-recipes at 21a7ff9. Reviewer independently passed 315 core, 12 CLI, 4 credential and 68 Flutter tests.
• Current-head PR Checks, Mobile Builds, Windows PTY and CodeQL passed, including all three previously failing regressions, pinned v0.49 host compatibility, five Windows process cases and four credential cases (including DPAPI).
• Full exact-SHA desktop validation passed on 4961d59, including all three builds, credential tests, native Board/editor/process/terminal tests, macOS presence, Windows single-instance and Linux E2E. All 30 native captures checked: 26 identical to inspected references, four macOS Board views inspected directly with small viewport differences and no new readability or overlap issue.
• This layer's review and checks are complete. It remains draft until the full stack and final top-SHA validation are complete.

Risks

• Desktop credential possession does not prove physical human presence or isolate malicious processes running as the same OS user. Unix private files and Windows user-scoped DPAPI protect storage; the CLI/RPC have no signing operation.
• Desktop launch/review UI and managed execution arrive in subsequent layers. No workflow worker can run through a shared-workspace fallback.