refactor: extract AryxAppService into focused service delegates

Extract seven responsibility clusters from the 3,466-line AryxAppService
monolith into focused service classes under src/main/services/:

- WorkflowManager: workflow CRUD, templates, validation, resolution
- McpProbeManager: MCP server probing, OAuth pre-auth, probe queuing
- DiscoveredToolingSyncService: tooling/customization scanning, watchers
- GitContextManager: git refresh orchestration, context updates, mutations
- CheckpointRecoveryManager: checkpoint retry/recovery state handling
- ApprovalCoordinator: approval/user-input/plan-review/OAuth state machine
- SessionTurnExecutor: turn execution, streaming deltas, finalization

AryxAppService remains the public facade consumed by IPC handlers but now
delegates internally via constructor-injected service instances. A new
AppServiceDeps type provides a clean dependency injection seam for testing.

The facade is reduced from 3,466 to 2,572 lines. All existing tests pass
with two test files migrated to constructor DI (appServiceGitRefresh,
appServiceMcpProbing). New focused tests added for WorkflowManager and
the DI seam itself.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/main/appServiceGitRefresh.test.ts

@@ -183,7 +183,19 @@ function createService(
     runTurn?: (command: RunTurnCommand) => Promise<[]>;
   },
 ): InstanceType<typeof AryxAppService> {
-  const service = new AryxAppService();
+  const service = new AryxAppService({
+    gitService: {
+      captureWorkingTreeSnapshot: async (projectPath: string, scannedAt: string) => {
+        options?.onCaptureSnapshot?.(projectPath, scannedAt);
+        return options?.snapshot;
+      },
+      captureWorkingTreeBaseline: async () => [],
+      computeRunChangeSummary: async (projectPath: string) => {
+        options?.onComputeRunSummary?.(projectPath);
+        return options?.runSummary;
+      },
+    } as never,
+  });
   const internals = service as unknown as Record<string, unknown>;
   internals.loadWorkspace = async () => {
     internals.workspace = workspace;
@@ -216,33 +228,11 @@ function createService(
         computeRunChangeSummary: (projectPath: string) => Promise<ProjectGitRunChangeSummary | undefined>;
       };
     }
-  ).sidecar = {
+    ).sidecar = {
     runTurn: async (command) => options?.runTurn ? options.runTurn(command) : [],
     resolveApproval: async () => undefined,
     resolveUserInput: async () => undefined,
   };
-  (
-    service as unknown as {
-      gitService: {
-        captureWorkingTreeSnapshot: (
-          projectPath: string,
-          scannedAt: string,
-        ) => Promise<ProjectGitWorkingTreeSnapshot | undefined>;
-        captureWorkingTreeBaseline: () => Promise<[]>;
-        computeRunChangeSummary: (projectPath: string) => Promise<ProjectGitRunChangeSummary | undefined>;
-      };
-    }
-  ).gitService = {
-    captureWorkingTreeSnapshot: async (projectPath, scannedAt) => {
-      options?.onCaptureSnapshot?.(projectPath, scannedAt);
-      return options?.snapshot;
-    },
-    captureWorkingTreeBaseline: async () => [],
-    computeRunChangeSummary: async (projectPath) => {
-      options?.onComputeRunSummary?.(projectPath);
-      return options?.runSummary;
-    },
-  };
 
   return service;
 }