whaleflow: wire codewhale-whaleflow into tui/cli (currently zero dependents)

[Hmbown]

codewhale-whaleflow (~5.2k lines: typed IR, Starlark authoring, replay, TraceStore) has no dependent crates. Add the dependency edge and the minimal end-to-end path: author → compile to IR → execute (mock or real) → record trace, reachable from crates/cli and crates/tui.

Acceptance: a workflow can be run end-to-end from the CLI behind a feature flag; the TUI can at least list runs.

Part of the v0.9.0 EPIC.

[Hmbown]

Kimi Code audit note, 2026-06-12:

When wiring Whaleflow into CLI/TUI, the Kimi /swarm lesson is worth folding into the entry-path design: /swarm <task> should become a Whaleflow run intent, not a revived model-visible agent_swarm tool.

Concrete framing:

• CLI/TUI entry creates a workflow_run with BranchSet/Leaf/Reduce shape when swarm-style fanout is useful.
• The run is the visible/control object; child subagents are headless lanes beneath it.
• Manual approval should happen at the workflow/run boundary where possible, while child permissions still flow through the subagent permission policy.
• Do not bring back the old standalone agent_swarm tool/card path that v0.8.5 chore(swarm): drop model-callable agent_swarm tool surface #332/v0.8.5: drop /swarm + agent_swarm tools; polish agent_spawn #336 retired.

Related Kimi-informed slice: #3178.