build(workflows): stamp source provenance and retire the dead availability flag

WHY THIS MATTERS
backend/src/lib/systemWorkflows.ts is 2.2 MB of generated code whose source
of truth lives in a different repository (mike-workflows), with nothing
recording WHICH commit it was generated from and no way to detect a stale
or hand-edited regeneration. Separately, the mike-availability frontmatter
flag became dead data in this PR: 31 workflows are marked "system" but the
default/add-on split is really the hardcoded DEFAULT_WORKFLOW_IDS list -
two contradictory sources of truth for a contract contributors rely on.

WHAT IS PROVENANCE FOR GENERATED CODE?
A committed generated file is only reviewable if a machine can reproduce
it: record the exact source commit in the output, and let CI regenerate
from that commit and diff. The generator now runs `git rev-parse HEAD` in
the mike-workflows checkout, stamps it into the file header, and exports
SYSTEM_WORKFLOWS_SOURCE_COMMIT for tooling to read.

DECISION ENCODED HERE
The app owns which workflows install as defaults (a product decision, in
code, reviewed in this repo); repository metadata does not. Therefore the
generator stops emitting `availability` (the key is still accepted with a
deprecation warning so existing content builds) and the generated file
drops all 135 availability lines. A new provenance test pins the contract:
the stamped commit matches /^[0-9a-f]{40}$/ and every DEFAULT_WORKFLOW_IDS
entry exists in the generated catalog.

ALSO
- pack.yaml validation is now bidirectional: a workflow directory present
  under a pack but missing from pack.workflows fails the build (previously
  a WIP folder would silently ship as part of the pack).
- localeCompare calls pin the "en" locale so regeneration is byte-stable
  across machines with different ICU collations.
- Regeneration verified: before these changes the committed file reproduced
  byte-for-byte from mike-workflows @ 4b9c7cd; after, the diff is exactly
  the header/constant plus the removed availability lines.

Found by review of PR #309.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4PXCdenNH5Mqhm5Sre9Zs