Add the xmd workflow start/resume filesystem vertical slice

[taras]

Story

As a workflow author, I want to start and resume a retained workflow through the same implicit Workspace, so an interrupted procedure continues from its journal frontier without reconstructing intermediate filesystem history.

Initial vertical slice

Implement the first complete xmd workflow path around declarative file effects:

xmd workflow start [--id=<run-id>] [--props-*=...] <definition>
xmd workflow resume <run-id>

Both commands run in the foreground, stream rendered output while the document executes, and return only when the execution completes, suspends, fails, is cancelled, or is interrupted.

start creates a WorkflowRun with one implicit root Workspace. A caller may supply --id; otherwise the host generates it. resume selects only by run ID and uses the retained immutable definition and props. A document path never selects a previous run.

The host installs retained contextual filesystem and cwd providers. Completed durable effects restore their recorded results. Ephemeral Workspace attachment and lexical contexts run again. Partial replay continues against the retained root at the journal frontier; completed root replay returns without attaching a Workspace provider.

The workflow command also installs #381's useWorkflowServiceDenial() inside each start and resume execution scope before importing or expanding the workflow document. The denial provider never delegates, so an API.Service provider inherited from the ordinary CLI host or programmatic caller cannot become native fallback execution. A future workflow service capability may replace it only at an explicitly authorized workflow adapter boundary; delegation must still terminate at the denial rather than escape to the caller's host.

Acceptance

• start creates or compatibly reuses exactly one run ID and rejects incompatible reuse.
• Root props use the existing --props-* CLI convention.
• A <File> mutation and filtered journal result use Commit Workspace mutations and journal results atomically #365's atomic transaction boundary.
• Interruption after one committed file effect resumes at the next effect against the same logical root.
• Interruption before commit reruns the effect against its pre-effect root.
• Create/delete/create histories restore from recorded results without filesystem replay guards.
• Completed replay performs no Workspace attachment or mutation.
• A missing or corrupt authoritative Workspace is an explicit unrecoverable error.
• Unsupported retained operations fail explicitly and never fall back to the caller's host filesystem.
• start and resume install the non-delegating workflow API.Service denial before root import or expansion; an inherited native provider is never called.
• Ordinary xmd run behavior is unchanged.

Intentionally excluded

• Status/list/history and lifecycle administration.
• Repository, Git, Agent, Worker Shell, native host services, and external effects.
• A workflow service provider or any other service-hosting mechanism.
• Remote workflow hosts or a public host selector.

Dependencies

• Add contextual workflow runs with pinned commits #289 / PR 💥 Add expansion identity and pinned-commit workflow runs #341 supplies WorkflowRun and expansion identity.
• Store WorkflowRuns and filtered journals in SQLite #291 supplies durable lookup and journal storage.
• Commit Workspace mutations and journal results atomically #365 supplies atomic Workspace effects.
• Replace findFreePort with scoped, replay-safe attached services #381 supplies API.Service and the independently testable, non-delegating workflow denial provider; this issue installs that denial at the new command's authorized adapter boundary.
• PR 📝 Specify retained workflow Workspaces #358 supplies the retained Workspace replay and lifecycle contract.
• End goal: Document adversarial implementation workflow WIP #181.