fix(workflows): restore discovery and authorize agent wake

[loganj]

🤖

Summary

• Restore Desktop workflow discovery when it batches multiple channel IDs in one #h filter.
• Define and implement a fail-closed authority contract for relay-signed workflow messages that wake agents.

Details

Desktop's global Workflows view can request workflows across multiple accessible channels. The relay previously applied those #h values only after a limited database read, so newer unrelated events could consume the page and hide valid workflows. Multi-channel #h values are now intersected with the authenticated reader's channel access and pushed into SQL before LIMIT; explicit channel filters continue to exclude global events.

Workflow send_message events are relay-signed, so ACP previously evaluated them as authored by the relay and rejected them under normal owner-only policy. Relay output now carries a dedicated workflow-owner authority tag while p tags remain attribution and mention routing only. ACP accepts that delegated principal only when the kind-9 event is validly signed by the configured endpoint's NIP-11 self identity and contains exactly one valid workflow marker and owner tag. Missing, malformed, ambiguous, or forged provenance falls back to ordinary signer authorization, and the derived owner still passes through existing respond_to and DM restrictions.

ARCHITECTURE.md documents both contracts. Regression coverage includes adversarial workflow provenance cases, access/requested-channel intersection, SQL-before-limit behavior, global exclusion, empty intersections, and emitted relay/owner provenance.