feat(workflows): Phase 1 backend — WorkflowDefinition model, persistence, IPC, sidecar execution

Introduce WorkflowDefinition as a first-class entity alongside PatternDefinition.

Shared domain:
- src/shared/domain/workflow.ts: new WorkflowDefinition, WorkflowGraph,
  WorkflowNode/Edge/Config types, normalization, TS-side validation, and
  buildWorkflowExecutionPattern (synthetic pattern bridge for session plumbing)
- workspace.ts: add workflows[] and selectedWorkflowId
- session.ts: add optional workflowId to SessionRecord
- runTimeline.ts: add optional workflowId/workflowName to run records
- sessionLibrary.ts: workflow-aware session search

IPC / main process:
- contracts/channels.ts, contracts/ipc.ts: workflow CRUD channels
- preload/index.ts: expose saveWorkflow, deleteWorkflow, createWorkflowSession
- ipc/registerIpcHandlers.ts: register workflow handlers
- persistence/workspaceRepository.ts: load/save/normalize workflows
- AryxAppService.ts: saveWorkflow, deleteWorkflow, createWorkflowSession,
  resolveSessionExecutionDefinition, workflow-aware turn/run plumbing

Sidecar protocol:
- contracts/sidecar.ts: ValidateWorkflowCommand, WorkflowValidationEvent,
  optional workflow on RunTurnCommand
- sidecarProcess.ts: validate-workflow command dispatch and event handling
- Contracts/ProtocolModels.cs: workflow DTOs and validate-workflow DTOs
- Services/SidecarProtocolHost.cs: validate-workflow command handler
- Services/CopilotWorkflowRunner.cs: workflow-aware build and checkpoint path
- Services/WorkflowValidator.cs: graph validation (connectivity, start/end,
  fan-out/in arity, path reachability)
- Services/WorkflowRunner.cs: WorkflowDefinitionDto -> Agent Framework Workflow
  builder (direct, fan-out, fan-in edges; agent executor binding)

Project: bump both csproj from net9.0 to net10.0

Tests:
- tests/shared/workflow.test.ts: TS workflow validation and pattern synthesis
- tests/main/appServiceWorkflow.test.ts: saveWorkflow / createWorkflowSession
- tests/Aryx.AgentHost.Tests/SidecarProtocolHostTests.cs: ValidateWorkflowCommand
- Fix two stale workspace fixtures missing workflows field

Validation: tsc clean, bun test 367/367 pass, dotnet test 244/244 pass, bun run build succeeds.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sidecar/src/Aryx.AgentHost/Services/SidecarProtocolHost.cs

@@ -11,6 +11,7 @@ public sealed class SidecarProtocolHost
 {
     private const string DescribeCapabilitiesCommandType = "describe-capabilities";
     private const string ValidatePatternCommandType = "validate-pattern";
+    private const string ValidateWorkflowCommandType = "validate-workflow";
     private const string RunTurnCommandType = "run-turn";
     private const string CancelTurnCommandType = "cancel-turn";
     private const string ResolveApprovalCommandType = "resolve-approval";
@@ -42,6 +43,7 @@ public sealed class SidecarProtocolHost
 
     private readonly Func<CancellationToken, Task<SidecarCapabilitiesDto>> _capabilitiesProvider;
     private readonly PatternValidator _patternValidator;
+    private readonly WorkflowValidator _workflowValidator;
     private readonly ITurnWorkflowRunner _workflowRunner;
     private readonly ICopilotSessionManager _sessionManager;
     private readonly JsonSerializerOptions _jsonOptions;
@@ -53,7 +55,7 @@ public sealed class SidecarProtocolHost
         new(StringComparer.Ordinal);
 
     public SidecarProtocolHost()
-        : this(new PatternValidator())
+        : this(new PatternValidator(), new WorkflowValidator())
     {
     }
 
@@ -62,9 +64,20 @@ public sealed class SidecarProtocolHost
         ITurnWorkflowRunner? workflowRunner = null,
         Func<CancellationToken, Task<SidecarCapabilitiesDto>>? capabilitiesProvider = null,
         ICopilotSessionManager? sessionManager = null)
+        : this(patternValidator, new WorkflowValidator(), workflowRunner, capabilitiesProvider, sessionManager)
+    {
+    }
+
+    public SidecarProtocolHost(
+        PatternValidator patternValidator,
+        WorkflowValidator workflowValidator,
+        ITurnWorkflowRunner? workflowRunner = null,
+        Func<CancellationToken, Task<SidecarCapabilitiesDto>>? capabilitiesProvider = null,
+        ICopilotSessionManager? sessionManager = null)
     {
         _patternValidator = patternValidator;
-        _workflowRunner = workflowRunner ?? new CopilotWorkflowRunner(_patternValidator);
+        _workflowValidator = workflowValidator;
+        _workflowRunner = workflowRunner ?? new CopilotWorkflowRunner(_patternValidator, _workflowValidator);
         _capabilitiesProvider = capabilitiesProvider ?? BuildCapabilitiesAsync;
         _sessionManager = sessionManager ?? new CopilotSessionManager();
         _jsonOptions = JsonSerialization.CreateWebOptions();
@@ -74,6 +87,7 @@ public sealed class SidecarProtocolHost
         {
             [DescribeCapabilitiesCommandType] = HandleDescribeCapabilitiesAsync,
             [ValidatePatternCommandType] = HandleValidatePatternAsync,
+            [ValidateWorkflowCommandType] = HandleValidateWorkflowAsync,
             [RunTurnCommandType] = HandleRunTurnAsync,
             [CancelTurnCommandType] = HandleCancelTurnAsync,
             [ResolveApprovalCommandType] = HandleResolveApprovalAsync,
@@ -180,6 +194,18 @@ public sealed class SidecarProtocolHost
         }, context.CancellationToken).ConfigureAwait(false);
     }
 
+    private async Task HandleValidateWorkflowAsync(CommandContext context)
+    {
+        ValidateWorkflowCommandDto command = DeserializeCommand<ValidateWorkflowCommandDto>(context);
+
+        await WriteAsync(context.Output, new WorkflowValidationEventDto
+        {
+            Type = "workflow-validation",
+            RequestId = context.Envelope.RequestId,
+            Issues = _workflowValidator.Validate(command.Workflow),
+        }, context.CancellationToken).ConfigureAwait(false);
+    }
+
     private async Task HandleRunTurnAsync(CommandContext context)
     {
         RunTurnCommandDto command = DeserializeCommand<RunTurnCommandDto>(context);