Reject cyclic workflow plan expansion

[rogierx]

Fixes #4462.

Summary

• add workflow dependency edges with registration-time duplicate, missing-step, lifecycle, and cycle rejection
• revalidate expanded workflow plans before dispatch so stale dynamic edge mutations cannot start execution
• preserve pending step/workflow state when dispatch is rejected and record sanitized audit decisions plus metrics counters
• export AgentStatus from src.agent so current orchestrator imports collect cleanly

Validation

• PYTHONDONTWRITEBYTECODE=1 uv run pytest tests/test_workflow.py -q -> 3 passed
• PYTHONDONTWRITEBYTECODE=1 uv run pytest -q --ignore=tests/test_metrics.py -> 21 passed
• PYTHONDONTWRITEBYTECODE=1 uv run flake8 src/orchestrator/workflow.py src/agent/__init__.py tests/test_workflow.py -> passed
• PYTHONDONTWRITEBYTECODE=1 python3 -m py_compile src/orchestrator/workflow.py src/agent/__init__.py tests/test_workflow.py -> passed
• git diff --check -> passed

Notes

• Full PYTHONDONTWRITEBYTECODE=1 uv run pytest -q was stopped after 30s in the existing metrics timer area after printing 16 dots.
• Full PYTHONDONTWRITEBYTECODE=1 uv run flake8 src/ tests/ still reports pre-existing style/import issues outside the touched files.
• Last duplicate check found only one claim-only issue comment and one retracted claim comment, with no [ Bounty $4k ] [ Workflow ] Detect cycles in dynamic edges — runtime plan expansion #4462 PR.