Implement v1.11 dynamic JS workflows

[enderzcx]

Summary

• Add preview-first dynamic JavaScript workflow runtime with AST policy and Node Permission Model child execution
• Add parent CWF JSON-RPC APIs for git, agents, map, artifacts, and reports
• Add dynamic workflow tests, fixture, CLI smoke coverage, and docs updates

Verification

• git diff --check
• npx vitest run tests/dynamic-workflow.test.ts
• npm run check
• bash scripts/smoke-cli.sh
• controlled live dynamic smoke: run_20260606040827_a9937v (2 read-only Codex workers completed)
• Reasonix final-review: approve, follow-up approve after template literal shell-string fix

Notes

• Dynamic safePatch is recognized but not executable until a v1.10 write_policy is attached to a dynamic run
• Controlled live smoke used a disposable local git repo only