feat: add an interactive saved workflow manager

[alectimison-maker]

Summary

• replace the /workflow plain-text ID dump with interactive workflow cards
• add Run, Rename, Export, and guarded Delete actions to each card
• add atomic saved-workflow rename support in the background store
• restore workflow manager bindings with persisted side-panel messages
• localize the new UI in every supported locale
• update the workflow documentation

Motivation

Saved workflows already support guarded replay, import/export, and deletion, but
/workflow currently renders a plain-text list. Users must copy opaque workflow
IDs into follow-up slash commands, and workflows cannot be renamed.

This adds a small management surface on top of the existing workflow APIs
without changing the workflow format or replay safety model.

Related to #442.

Design

The manager is rendered inside the existing /workflow system message. Each
workflow card displays its name, ID, step count, and parameter count.

Run and Export reuse the existing execution paths. Delete uses the existing
background operation but requires a second click within four seconds.

Rename adds a serialized background operation backed by the saved-workflow
store. It normalizes the new name and updates only name and updatedAt;
workflow identity, creation time, steps, parameters, targets, and safety
metadata are preserved.

Workflow names and metadata are rendered through DOM text nodes rather than
HTML interpolation.

Safety

• no workflow schema changes
• no new extension permissions
• no changes to the guarded replay executor
• rename preserves workflow steps and parameters
• empty names and unknown workflow IDs fail closed
• deletion requires an explicit second click
• runtime parameter values remain outside persisted workflows

Testing

• saved-workflow store rename, preservation, and failure cases
• Chrome/Firefox manager and background wiring
• Chrome/Firefox changed-line parity
• locale-key parity across all 23 supported locales
• node test/security/injection-corpus.mjs — 60/60 passed
• node test/rich-text-toolbar-guard.mjs — 33 passed
• JavaScript syntax checks passed
• 360px side-panel rendering verified with no horizontal overflow

node test/run.js currently reports 1515/1516 passing. The remaining failure is
also present on upstream main: package.json is version 26.2.2 while the
newest CHANGELOG.md entry is 26.2.0.

Compatibility and risks

Existing saved workflows remain compatible because the stored schema and replay
executor are unchanged. The UI intentionally reuses the current background
operations instead of adding a second management surface.

Scope

Teacher mode (#197) and opt-in persisted locator healing remain separate
follow-up changes.

[vercel]

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.