feat: Add native dynamic workflows runtime

[GGtoms]

Summary

• Add a native Dynamic Workflows runtime and built-in workflow tool for JavaScript workflow scripts.
• Route workflow agent() calls through Reasonix internal subagents instead of spawning external CLI subprocesses.
• Add orchestration primitives and helpers: parallel, pipeline, phase, log, dry-run, validate-only, verifier/review/synthesis helpers, concurrency limits, max-agent limits, cancellation, and structured failure kinds.
• Add session-managed workflow runs with /workflows list/show/attach/use/continue/stop/retry/delete/save/run support, saved workflow completions, busy-state command handling, and richer run diagnostics.
• Add workflow model policy routing through the existing /model command family and document user-facing CLI controls.

Motivation

Large repository audits, multi-module bug hunts, architecture reviews, and refactors need a first-class way to coordinate parallel subagent work. This implements that flow inside Reasonix without relying on a skill layer or starting reasonix run child processes.

This PR replaces #2324 with a cleaner history: one feature commit rebased onto the current upstream main.

Design Notes

• Workflow scripts run in a constrained runtime surface rather than as shell scripts.
• agent() uses Reasonix's internal subagent runner and keeps the existing spawn_subagent tool intact.
• Background and foreground workflow executions are tracked through the workflow run manager so slash commands can inspect, stop, retry, attach, and resume runs.
• tool_mode=full still flows through the existing Reasonix permission and apply gates.
• Script failures, internal failures, and aborted runs are classified separately via error_kind.
• Tool guidance clarifies that agent() and synthesize() return strings directly, and that parallel concurrency is controlled by workflow tool options or /workflows run --concurrency.

Validation

• npm run verify
  • build passed
  • lint passed with the existing src/cli/ui/PlanPanel.tsx import-type warning
  • typecheck passed
  • tests passed: 330 files, 4139 passed, 9 skipped
• The same verification suite also passed during the pre-push hook before publishing codex/native-dynamic-workflows.