feat(workflow): add workflow DSL commands

[samzong]

Summary

• Add builder-defined workflow commands in cli.yaml that compile into normal Cobra root commands.
• Route workflow steps through the shared runtime operation invoker so auth, request construction, output, dry-run metadata, pagination, and wait behavior stay aligned with generated API commands.
• Expose workflow commands in catalog/verify contracts and document the v0 linear, fail-fast DSL boundary.

Verification

• rtk make check
• pre-ship --committed: 0 MUST-FIX findings; sentinel /tmp/.preship-ok-bb7b2557681948c8 written

Compatibility

• Catalog schema version increases to 11 for workflow command metadata.
• Generated CLIs may expose workflow.dsl when workflows are configured.
• Workflow commands are additive and mounted as normal root commands; conflicting framework, module, shortcut, or workflow roots are rejected during codegen.

Checklist

• Tests or focused verification cover the changed surface.
• User-facing behavior changes are documented.
• Generated output under internal/generated/, .cache/, and ad-hoc skills/<cli-name>/ directories is not committed.
• Commits are signed off when this is ready to merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a27841bc7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Coerce JSON workflow numbers before query serialization

When a workflow maps a numeric field from a prior JSON step into an int64 operation parameter, encoding/json provides the value as float64; returning it unchanged here ignores p.GoType, and the later query builder only serializes int64, bool, []string, and string, so a required query value like params: {limit: ${steps.lookup.limit}} is silently omitted from the request URL.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject body setters on bodyless workflow steps

If a workflow step includes set or set_str for an operation whose spec has no request body, input.BodySets/BodyStringSets is non-empty but this branch returns nil before checking it, so the generated workflow sends the API call without the configured body instead of failing fast; this is reachable because workflow codegen validates params keys but does not reject body setters for bodyless operations.

Useful? React with 👍 / 👎.