feat(serve): expose workflow tasks and controls

[qqqys]

Note

This draft is stacked on #9034. Its current main diff temporarily includes the Core prerequisite; after #9034 merges, this branch will merge main normally so the review diff shrinks to the daemon/API layer without force-pushing.

What this PR does

This PR exposes Workflow task snapshots and control operations through the ACP bridge, serve-mode routes, telemetry, TypeScript SDK, and the daemon adapter consumed by WebUI. It translates the Core execution state from #9034 into a stable transport contract.

This is the second layer split from #8950. It intentionally contains no Web Shell components or presentation behavior.

Why it's needed

The Workflow UI needs a supported way to list task state, observe transitions, inspect results, and request cancellation. Keeping those operations in a dedicated daemon/API layer prevents the UI from reaching into Core internals and gives other SDK consumers the same contract.

Reviewer Test Plan

How to verify

After #9034 lands and the branch is rebased by an ordinary merge, run the focused bridge, ACP session, serve transport, SDK, and daemon-adapter tests. Confirm task snapshots preserve lifecycle state and that cancellation and capability discovery round-trip through each transport boundary.

Evidence (Before & After)

N/A — non-UI transport and SDK change.

Tested on

OS	Status
🍏 macOS	✅
🪟 Windows	⚠️
🐧 Linux	⚠️

Environment (optional)

Node.js 25.9.0 on macOS arm64. ACP bridge: 575 tests passed. TypeScript SDK: 492 tests passed. WebUI daemon adapter: 73 tests passed. Workflow-focused serve tests passed. Bridge, SDK, and WebUI builds/type-checks passed. The broad CLI type-check remains blocked by the repository's existing local Ink type mismatch outside this diff.

Risk & Scope

• Main risk or tradeoff: The added transport types and routes become a compatibility boundary across bridge, CLI, SDK, and WebUI consumers.
• Not validated / out of scope: Web Shell presentation, full cross-platform CI, and unrelated existing CLI auth/extension and Ink failures.
• Breaking changes / migration notes: None intended; routes and SDK types are additive.

Linked Issues

Closes #9033

中文说明

[!NOTE]
本草稿堆叠在 #9034 之上。它当前相对 main 的 diff 暂时包含 Core 前置改动；#9034 合并后，本分支会通过普通 merge 合入 main，让评审 diff 自然缩小为 daemon/API 层，不进行 force-push。

本 PR 做了什么

本 PR 通过 ACP bridge、serve 路由、telemetry、TypeScript SDK 和 WebUI 使用的 daemon adapter 暴露 Workflow 任务快照与控制操作。它把 #9034 的 Core 执行状态转换为稳定的传输契约。

这是从 #8950 拆出的第二层，刻意不包含 Web Shell 组件或展示行为。

为什么需要

Workflow UI 需要受支持的方式来列出任务状态、观察状态转换、查看结果并请求取消。把这些操作放在独立的 daemon/API 层，可以避免 UI 直接依赖 Core 内部实现，也让其他 SDK 消费方共享同一契约。

Reviewer 测试计划

如何验证

等 #9034 合并并通过普通 merge 更新本分支后，运行聚焦的 bridge、ACP session、serve transport、SDK 和 daemon adapter 测试。确认任务快照保留完整生命周期状态，并且取消与能力发现能在每个传输边界正确往返。

证据（前后对比）

不适用——这是非 UI 的传输与 SDK 改动。

测试平台

OS	状态
🍏 macOS	✅
🪟 Windows	⚠️
🐧 Linux	⚠️

环境（可选）

macOS arm64，Node.js 25.9.0。ACP bridge 575 个测试通过；TypeScript SDK 492 个测试通过；WebUI daemon adapter 73 个测试通过；Workflow 聚焦的 serve 测试通过。Bridge、SDK 和 WebUI 的构建与类型检查通过。CLI 的宽泛类型检查仍被仓库现有、位于本 diff 之外的本地 Ink 类型不匹配阻塞。

风险与范围

• 主要风险或取舍：新增传输类型与路由会成为 bridge、CLI、SDK 和 WebUI 消费方之间的兼容边界。
• 未验证或不在范围内：Web Shell 展示、完整跨平台 CI，以及无关的现有 CLI auth/extension 和 Ink 失败。
• 破坏性变更或迁移说明：预期没有；路由和 SDK 类型都是增量能力。

关联 Issue

Closes #9033