feat(agent-center): persist workflow run state

[suoak]

Summary

• persist workflow run instances and per-node execution state
• support agent/tool advancement, approval pause/resume/reject, and restricted conditions
• expose authenticated workflow-run APIs with ownership isolation and CSRF protection
• correlate created conversations with their workflow run IDs

Testing

• cargo fmt --all -- --check
• migration immutability check
• push-triggered API type tests on Windows, macOS, and Linux
• full local workspace checks (blocked because this Windows host has no MSVC link.exe; PR CI is the cloud validation path)