[3/5] Workflow contract and module architecture

[odyslam]

Supersedes the closed oversized PR #90 and consolidates the previous workflow-contract / module-split slices (#99 + #100).

Review order

1. [1/5] Human CLI output and agent contract guards #96: Human CLI output and agent contract guards
2. [2/5] API command and workflow output foundation #98: API command and workflow output foundation
3. [3/5] Workflow contract and module architecture #100: Workflow contract and module architecture ← this PR
4. [4/5] OpenAPI operation routing for workflows #101: OpenAPI operation routing for workflows
5. [5/5] Generated-client pruning and stale API cleanup #102: Generated-client pruning and stale API surface cleanup

Base / head

Base: codex/pcl-output-contract-workflows
Head: codex/pcl-workflow-module-split

What changed

• Refactors workflow/action metadata into clearer contract definitions.
• Splits the workflow layer into per-surface modules rather than one large workflow implementation.
• Keeps schema and manifest output aligned with top-level workflow commands.

Review focus

• Workflow/action contract definitions and generated schema/manifest compatibility.
• Module boundaries for incidents, projects, releases, access, integrations, protocol-manager, events, search, and related surfaces.
• Whether adding a new API-backed workflow/action now has an obvious file and pattern.

Validation

Validated on the final stack tip codex/pcl-slim-generated-client:

• make ci
• Local ./target/debug/pcl workflows --toon, schema list --toon, and api manifest --toon smoke.