refactor!: cut over to workflow architecture

[demetere]

Summary

• Cut pi-hive over from the legacy agent/plan engine to the config-first Workflow API architecture, including immutable snapshots, capability policy, durable orchestration, artifact adapters, knowledge workflows, and observability.
• Restore the mission-control dashboard on Workflow API v1 and add model-aware frozen context budgeting with compatible inherited-model negotiation.
• Add full authority-preserving macOS runtime support alongside Linux through descriptor-relative filesystem operations, process/boot identity verification, ownership recovery, locks, leases, and process-group cancellation.
• Package verified arm64 and x64 Darwin N-API helpers, add macOS CI, and continue rejecting Windows before runtime activation.
• Update documentation, release verification, package checks, examples, and regression coverage.

Verification

• just ci on macOS: passed
  • Node suite: 969 tests, 964 passed, 5 skipped, 0 failed
  • Bun workflow database suite: 49 passed, 0 failed
  • Dashboard unit suite: 13 passed
  • Playwright/accessibility suite: 8 passed
  • typecheck, lint, schemas, dashboard freshness, native fingerprints, package files, package budgets, licenses, and packed-install verification passed
• just test-node-compat on macOS: 462 tests, 458 passed, 4 skipped, 0 failed
• Linux Docker parity run passed all runtime tests; only release-SBOM tests requiring the repository CI install layout were excluded from that ad hoc container result.
• Package verification: 183 files, 596,706 packed bytes, 2,626,453 unpacked bytes.
• Darwin helpers verified for arm64 and x86_64 and passed code-signature validation.