feat: add session-driven AI workflow

[chenquan]

Summary

• add a session-bound, resumable workflow runtime for Codex and Claude Skills
• add workflow CLI commands for status, begin, checkpoint, verify, approval, pause, resume, and cancel
• add strict runtime/config validation, leases, evidence digests, recovery, docs, and OpenSpec artifacts

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• openspec validate --all --strict (21/21)
• isolated fresh-binary E2E for completion, approval, timeout, lease, recovery, tamper, and idempotency paths