v2.0.0 — create_workflow_from_template, and VKS kubeconfig tools at their new names

Breaking: one of Pilot's own MCP tools is renamed. plan_workflow → create_workflow_from_template.
It never produced a dry-run plan: it builds the steps a template (workflow_type + params, built-in or
custom YAML) defines and saves the workflow in state pending, ready for run_workflow — a write.
"plan" read as a look that changes nothing. The new name says what it does and sets it apart from
create_workflow, which saves a step list you write yourself. Parameters, results, risk label and
annotations are unchanged; the MCP instructions and the tool's description now say this.

Old	New
plan_workflow	create_workflow_from_template

• vmware-vks renamed get_supervisor_kubeconfig → issue_supervisor_kubeconfig and
  get_tkc_kubeconfig → issue_tkc_kubeconfig (they hand out a live credential). The skill catalog
  lists them under the new names, still at high (credential access is gated).
• CLI commands are unchanged.
• Saved workflows keep working: a stored workflow, YAML file, draft or undo descriptor whose step names
  pilot.plan_workflow or a VKS get_*_kubeconfig tool is translated to the new name when Pilot builds
  the step, like the other 2.0 renames.
• Deny rules in ~/.vmware/rules.yaml written with the old names keep working (vmware-policy matches
  both names); vmware-audit policy lists any rule that now matches more.
• Requires vmware-policy ≥ 1.19.0, which carries these three pairs in
  vmware_policy.renames.
• Upgrade vmware-vks to 3.0.0 together with this release. Pilot 2.0 calls the kubeconfig tools by
  their new names, which vmware-vks 2.x does not register; Pilot does not depend on vmware-vks, so
  upgrading Pilot alone leaves those steps pointing at tools that do not exist yet.