Unify generated workflow templates

[c0da-ricon]

Problem

shimmer workflows:generate uses two different template mechanisms for generated agent workflows:

• .github/templates/agent-run.yml is copied directly.
• .github/templates/agent-scheduled.yml is rendered with envsubst for scheduled workflows.
• Per-agent manual workflow files (<agent>.yml) are embedded inline as a heredoc inside .mise/tasks/workflows/generate.

That split makes workflow changes easier to miss. A maintainer updating generated caller secrets or structure has to remember both the scheduled template and the embedded manual-workflow heredoc.

Suggested direction

Move the per-agent manual workflow heredoc into a .github/templates/agent-manual.yml (or similarly named) template and have workflows:generate render it through the same file-template path as scheduled workflows.

Acceptance criteria:

• No generated workflow YAML is embedded as a large heredoc in .mise/tasks/workflows/generate.
• Manual and scheduled caller workflows share a consistent render path.
• shimmer workflows:generate --check continues to detect drift.
• Tests cover that generated manual and scheduled callers forward the same shared secret set where intended.