fix(cloud): exclude config-shaped files from flow discovery

[finalerock44]

Flow discovery excluded config files by filename: literally config.yaml / config.yml, plus the exact --config target. A second workspace config sharing the folder (config_build.yml alongside config_update.yml, as when one folder serves several CI workflows) survived discovery, got parsed as a flow, and failed with "Expected an array of steps".

Add isWorkspaceConfigFile(), which classifies by shape rather than filename: no --- separator, a top-level map, and at least one workspace-config-only key. Requiring a recognised key keeps a flow that is merely missing its --- separator loud rather than silently dropped. Applied in plan() after applyFlowGlobs so it covers both the glob and default branches, and in planSingleFile so a custom-named config passed as the input gets the existing "pass the workspace folder path" error.

Also fixes the sibling path-matching bugs in applyFlowGlobs, which are the same defect family. --config is now resolved once in plan() and both branches compare normalised absolute paths:

• the default branch used file.endsWith(configFile), so --config ./x.yml failed to match and --config g.yml would have dropped flow-config.yml
• the glob branch compared a workspace-relative match against path.basename(configFile), which only matched when the config sat at the workspace root
• the config.yaml / config.yml name checks are anchored to the basename, so a genuine flow named my-config.yaml is no longer dropped; a real config with that name is still excluded, by shape

The --exclude-flows workaround is no longer needed. The hand-rolled extension and .app-bundle checks in the glob branch are replaced with the existing isFlowFile helper, which does exactly that.

Closes #99

What & why

Type of change

• fix — bug fix
• feat — new feature
• perf — performance improvement
• refactor — code change that's neither a fix nor a feature
• docs — documentation only
• chore / ci / build / test — tooling, no user-facing change
• Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

• PR title follows the Conventional Commits format (see comment above)
• pnpm lint passes
• pnpm typecheck passes
• pnpm build passes
• I have not bumped the version or edited CHANGELOG.md (release-please handles this)
• I have signed the CLA (the bot will prompt on first contribution)
• Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.