feat(ultracode): complete workflow orchestration support

[yishuiliunian]

Summary

Complete the Ultracode workflow orchestration V1 and close the related execution, authority, secret-sink, durability, and coverage boundaries.

Changes

• Add the Hub-owned WorkflowCoordinator, journal recovery, scheduling, retries, cancellation, exact leases, typed control APIs, projections, tools, settings, and mock-LLM scenarios.
• Preserve dependency declaration order and enforce bounded workflow output, dependency aggregation, completion, prompt, journal, and IPC frame sizes.
• Harden authenticated authority, permission and spawn audits, MCP/provider-secret handling, final result sinks, process ownership, and workflow journal identity.
• Add scoped coverage tooling and regression/branch tests across protocol, Hub, Agent, runtime, storage, ACP/TUI/Desktop, and end-to-end paths.

Verification

• bazel test //... --test_output=errors (118 targets; 116 passed, 2 Windows-only targets incompatible on macOS)
• bazel build //... --config=clippy
• bazel build //... --config=rustfmt
• bazel run //tools/coverage:scope_review
• Scoped coverage: 97.84% lines/regions, 98.87% functions, 90.98% branches
• actionlint, shellcheck, bash -n, and diff checks completed

Generated with Codex

[yishuiliunian]

Local verification: bazel test //crates/loopal-agent-hub:loopal-agent-hub-unit-test passed. Worktree clean; affected-source diff check passed. Waiting for full CI, including Windows identity and Job Object gates.