Workflow transparency: process map, duplicate & edit, pre-flight gate, senior-partner review, completion report

Workflows are now a declared, inspectable process rather than an opaque prompt.

- Blueprint (lib/workflows/blueprint.ts): one LLM call derives a typed spec
  from prompt_md/columns - per step name, objective, role, depends_on,
  inputs, outputs, testable quality_criteria and silent-failure exposure.
  Cached in workflow_blueprints, keyed by a hash of the source so it
  invalidates on edit. Tool allowlists stay server-derived from the role.

- Overview page: WorkflowDetailPage is tabbed, opening on a DAG process map
  plus per-step cards and a workflow-wide silent-failure assessment.

- Duplicate & edit with AI: POST /workflows/:id/duplicate (works on
  read-only builtins) + /edit-chat. Returns a complete revision and a change
  list; nothing saves until the user applies it.

- Pre-flight gate (lib/workflows/preflight.ts): samples the documents
  actually attached and re-scores each step. High risk parks the run at
  status 'paused' with nothing executed - continue anyway, or stop and edit.
  Fails open but loud if the check itself errors.

- Senior-partner review (lib/agents/partnerReview.ts): adjudicates each step
  against its criteria with reasons and an inference level, sending failures
  back for rework up to max_rework. The reviewer never rewrites the work,
  cannot_assess is a defect not a pass, and a failed reviewer marks the step
  degraded rather than silently passing it.

- Live run view: steps expanded by default, thinking trace inline, process
  map with the current step and a distinct reworking state.

- Completion report (lib/agents/report.ts, GET /agents/:id/report): built
  from persisted data only, so it cannot itself hallucinate.

Fixes: /workflows/:id/compile selected a non-existent skill_md column
(prompt_md is the column), so plan templates compiled from an empty string.

Migration: 20260726_01_workflow_blueprints.sql (already applied to prod).