feat(workflows): add host-managed workflow runs

[pascalandr]

Summary

• Add a generic sequential workflow runtime owned by CodeNomad with atomic persistence, restart recovery, cancellation, timeouts, bounded output/history, SSE updates, and multiple human review gates.
• Add a localized Workflows panel for creating pipelines, monitoring stages, reviewing output, approving gates, cancelling runs, and opening generated sessions.
• Add a thin OpenCode plugin bridge for starting, listing, inspecting, and cancelling runs. Approval mutations remain exclusive to the authenticated user API so plugin credentials and YOLO cannot bypass a human gate.
• Add stable workspace lineage identity so force-created same-path instances remain isolated and review-pending runs rebind safely after desktop restore.

Safety

• Reserve one workflow per workspace lineage and retain reservations when OpenCode cannot confirm session termination.
• Reconcile list and SSE updates without comparing client/server clocks or reverting concurrent terminal state.
• Keep history pruning best effort so cleanup failures cannot turn successful runs into failures.

Validation

• npm run typecheck
• npm run typecheck --workspace @neuralnomads/codenomad
• npm run build --workspace @codenomad/ui
• npm run build --workspace @codenomad/codenomad-opencode-plugin
• 151 changed runnable UI/plugin tests passed
• 24 focused server tests passed
• Full server suite: 243 passed, 3 skipped, with the unchanged Windows git-worktrees branch-name assertion as the sole failure
• Final gatekeeper review: zero actionable findings

Closes #435