feat(dag): unify workflow authoring and blocks - #229

Summary

• Establish WorkflowAuthoring as the single raw-source to prepared-graph admission boundary for validate, start, extend, replan, read, list, CLI generation, and packaging.
• Internalize composable workflow block capabilities while keeping heuristic routing runtime-owned and external Skill-independent.
• Hide runtime-owned authoring fields, validate model catalogs from one immutable environment snapshot, and fail closed for YAML, compatibility SHA, provenance, and release packaging.
• Preserve third-party MIT notices and source provenance in runtime/config distribution artifacts.

Verification

• Standards review: PASS, 0 findings.
• Spec review: PASS, 0 findings.
• OpenCode focused suite: 219 pass, 0 fail.
• Core focused suite: 24 pass, 0 fail.
• Full repository lint: pass within existing warning budget.
• Pre-commit full typecheck: 29/29 tasks pass.

Sequencing

The config branch remains intentionally fail-closed. After this PR merges, backfill runtime-compat.json with the merged runtime SHA, rerun the 17-template portable gate, then open the config PR.