feat(workflow): implement bounded Dynamic Workflow runtime

[stgmt]

Summary

• Consolidate Dynamic Workflow ownership in one canonical specification.
• Add a shipped bounded runtime with packet admission, root/worktree preflight, fenced state and leases, retry circuits, captured processes, partial results, staged mutation, journal, replay, incident reconciliation, and consumer census.
• Integrate deterministic spec phase execution and canonical Docker BDD coverage.
• Publish the honest guarantee tier as STEERING_ONLY because native Agent pre-spawn enforcement is not proven.

Verification

• npm run build:dynamic-workflow
• Focused ESLint for the runtime, step definitions, and phase runner.
• npm run check:skill-health: 0 blocking findings; 3 baselined findings.
• Filtered Docker BDD: 28/28 scenarios and 154/154 steps passed.
• Canonical full Docker BDD refreshed Dynamic Workflow coverage to 28/28; the repository-wide suite was red in areas outside Dynamic Workflow; no Dynamic Workflow scenario failed.
• MCP conformance: 0 findings.
• Scoped MCP coverage: 28 passed, 0 failed, undefined, or not run.
• Dependency-absent foreign-CWD runtime smoke passed.

Honest limits

• Native Agent deny is unavailable; no protected hook was installed.
• Process-tree cancellation and token ceilings remain best-effort/monitored where the host cannot prove stronger guarantees.
• The second supplied incident remains provenance-only without original producer artifacts.

🤖 Generated with Claude Code