feat(workflows): Phase 1 backend — WorkflowDefinition model, persistence, IPC, sidecar execution

Introduce WorkflowDefinition as a first-class entity alongside PatternDefinition.

Shared domain:
- src/shared/domain/workflow.ts: new WorkflowDefinition, WorkflowGraph,
  WorkflowNode/Edge/Config types, normalization, TS-side validation, and
  buildWorkflowExecutionPattern (synthetic pattern bridge for session plumbing)
- workspace.ts: add workflows[] and selectedWorkflowId
- session.ts: add optional workflowId to SessionRecord
- runTimeline.ts: add optional workflowId/workflowName to run records
- sessionLibrary.ts: workflow-aware session search

IPC / main process:
- contracts/channels.ts, contracts/ipc.ts: workflow CRUD channels
- preload/index.ts: expose saveWorkflow, deleteWorkflow, createWorkflowSession
- ipc/registerIpcHandlers.ts: register workflow handlers
- persistence/workspaceRepository.ts: load/save/normalize workflows
- AryxAppService.ts: saveWorkflow, deleteWorkflow, createWorkflowSession,
  resolveSessionExecutionDefinition, workflow-aware turn/run plumbing

Sidecar protocol:
- contracts/sidecar.ts: ValidateWorkflowCommand, WorkflowValidationEvent,
  optional workflow on RunTurnCommand
- sidecarProcess.ts: validate-workflow command dispatch and event handling
- Contracts/ProtocolModels.cs: workflow DTOs and validate-workflow DTOs
- Services/SidecarProtocolHost.cs: validate-workflow command handler
- Services/CopilotWorkflowRunner.cs: workflow-aware build and checkpoint path
- Services/WorkflowValidator.cs: graph validation (connectivity, start/end,
  fan-out/in arity, path reachability)
- Services/WorkflowRunner.cs: WorkflowDefinitionDto -> Agent Framework Workflow
  builder (direct, fan-out, fan-in edges; agent executor binding)

Project: bump both csproj from net9.0 to net10.0

Tests:
- tests/shared/workflow.test.ts: TS workflow validation and pattern synthesis
- tests/main/appServiceWorkflow.test.ts: saveWorkflow / createWorkflowSession
- tests/Aryx.AgentHost.Tests/SidecarProtocolHostTests.cs: ValidateWorkflowCommand
- Fix two stale workspace fixtures missing workflows field

Validation: tsc clean, bun test 367/367 pass, dotnet test 244/244 pass, bun run build succeeds.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/main/appServiceWorkflow.test.ts

@@ -0,0 +1,115 @@
+import { describe, expect, mock, test } from 'bun:test';
+
+import { buildAvailableModelCatalog } from '@shared/domain/models';
+import type { WorkflowDefinition } from '@shared/domain/workflow';
+import { createWorkspaceSeed, type WorkspaceState } from '@shared/domain/workspace';
+
+mock.module('electron', () => {
+  const electronMock = {
+    app: {
+      isPackaged: false,
+      getAppPath: () => 'C:\\workspace\\personal\\repositories\\aryx',
+      getPath: () => 'C:\\workspace\\personal\\repositories\\aryx\\tests\\fixtures',
+    },
+    dialog: {
+      showOpenDialog: async () => ({ canceled: true, filePaths: [] }),
+    },
+    shell: {
+      openPath: async () => '',
+    },
+  };
+
+  return {
+    ...electronMock,
+    default: electronMock,
+  };
+});
+
+mock.module('keytar', () => ({
+  default: {
+    getPassword: async () => null,
+    setPassword: async () => undefined,
+    deletePassword: async () => false,
+  },
+}));
+
+const { AryxAppService } = await import('@main/AryxAppService');
+
+function createService(workspace: WorkspaceState): InstanceType<typeof AryxAppService> {
+  const service = new AryxAppService();
+  const internals = service as unknown as Record<string, unknown>;
+  internals.loadWorkspace = async () => workspace;
+  internals.persistAndBroadcast = async (nextWorkspace: WorkspaceState) => nextWorkspace;
+  internals.loadAvailableModelCatalog = async () => buildAvailableModelCatalog();
+  return service;
+}
+
+function createWorkflow(): WorkflowDefinition {
+  return {
+    id: 'workflow-test',
+    name: 'Workflow Test',
+    description: 'Simple workflow',
+    createdAt: '2026-04-05T00:00:00.000Z',
+    updatedAt: '2026-04-05T00:00:00.000Z',
+    graph: {
+      nodes: [
+        { id: 'start', kind: 'start', label: 'Start', position: { x: 0, y: 0 }, config: { kind: 'start' } },
+        {
+          id: 'agent-primary',
+          kind: 'agent',
+          label: 'Primary',
+          position: { x: 200, y: 0 },
+          order: 0,
+          config: {
+            kind: 'agent',
+            id: 'agent-primary',
+            name: 'Primary',
+            description: 'Main agent',
+            instructions: 'Help the user',
+            model: 'gpt-5.4',
+          },
+        },
+        { id: 'end', kind: 'end', label: 'End', position: { x: 400, y: 0 }, config: { kind: 'end' } },
+      ],
+      edges: [
+        { id: 'e1', source: 'start', target: 'agent-primary', kind: 'direct' },
+        { id: 'e2', source: 'agent-primary', target: 'end', kind: 'direct' },
+      ],
+    },
+    settings: {
+      checkpointing: { enabled: false },
+      executionMode: 'off-thread',
+    },
+  };
+}
+
+describe('AryxAppService workflow operations', () => {
+  test('saves workflows into workspace state', async () => {
+    const workspace = createWorkspaceSeed();
+    const service = createService(workspace);
+
+    const result = await service.saveWorkflow(createWorkflow());
+
+    expect(result.workflows).toHaveLength(1);
+    expect(result.selectedWorkflowId).toBe('workflow-test');
+  });
+
+  test('creates workflow-backed sessions', async () => {
+    const workspace = createWorkspaceSeed();
+    const project = {
+      id: 'project-1',
+      name: 'Project',
+      path: 'C:\\workspace\\project-1',
+      addedAt: '2026-04-05T00:00:00.000Z',
+    };
+    workspace.projects.push(project);
+    workspace.workflows.push(createWorkflow());
+    const service = createService(workspace);
+
+    const result = await service.createWorkflowSession(project.id, 'workflow-test');
+    const session = result.sessions[0];
+
+    expect(session?.workflowId).toBe('workflow-test');
+    expect(result.selectedWorkflowId).toBe('workflow-test');
+  });
+});