feat(workflow): generate verified task DAGs

[MiMoHardFather]

What changed

• add /workflow <task> for primary-agent-generated inline JavaScript DAGs
• support natural-language tasks with optional JSON overrides for roles, prompts, models, tools, schemas, isolation, and dependencies
• add sandbox dag(nodes, run) with strict preflight validation, cycle detection, deterministic dependency ordering, and concurrent ready-batch scheduling
• require an independent structured verifier with bounded semantic rework (default 2 rounds, hard maximum 3)
• reuse existing workflow agent semaphores and journal replay for concurrency limits and persistent recovery
• enable workflow tooling and /workflow by default, with MIMOCODE_EXPERIMENTAL_WORKFLOW_TOOL=false or 0 as an explicit opt-out

Verification

• bun test test/command/workflow-command.test.ts test/command/deep-research-command.test.ts test/workflow/sandbox.test.ts test/workflow/builtin.test.ts test/tool/describe-workflow.test.ts — 51 passed
• bun test test/workflow/runtime-nested.test.ts test/workflow/retry.test.ts test/workflow/persistence.test.ts — 26 passed, 1 skipped
• bun test test/flag/workflow-tool.test.ts test/command/workflow-command.test.ts test/command/deep-research-command.test.ts — 9 passed
• bun typecheck — passed
• git diff --check — passed

Known baseline issue

test/workflow/runtime.test.ts retains pre-existing 5-second timeout/process instability when run as a broad band. The focused sandbox suite and stable runtime, retry, and persistence suites pass.