Workflow engine step 1: the pure core — workflow.js, artifact.js and the blank preset #1290

Written-by: Dev3

Step 1 of #1272: the pure core of the workflow engine. The parent issue stays open — step 2 is the repo-dev preset plus the fact providers that mirror enqueue-guard.mjs / merge-gate.mjs, step 3 is the Workflows page.

What this step is

A workflow is data: nodes (each naming the Bot that does it, plus typed inputs / outputs), edges binding one node's output to another node's input, and declared loops. Nothing here reads a repository, a clock or a model.

• core/src/shared/artifact.js — the artifact vocabulary and revisions: check:tests-ok, verdict, branch, pr, mergeable, merge-commit, release, risk:tier, generic doc|file|link|text, and freshness(input, currentRevision), which keeps "present" and "current" apart and treats an unreadable fact as a refusal, not a match.
• core/src/shared/workflow.js — validateWorkflow (each way a definition cannot run, its own sentence), workflowColumns (the definition's node ids are the board's columns; no built-in list), layoutWorkflow (one box per node carrying its Bot and rails, one edge per edges[] row, ranks left to right), enterNode / inputStates / renderRefusal (missing and stale, naming both revisions, in the node's own wording when it has one), holderOf (the node's Bot, which is the card's assignee).
• core/src/shared/workflow-blank.js — the blank preset as plain data: three nodes, one Bot each, no guards, no repository.

Acceptance it covers, and what it does not

Covered at the engine level: 1 (nodes are data — the blank preset and a five-node content workflow go through the same calls), 2 (the flowchart is asserted against the definition), 3 (each validation error has its own message and its own test), 4 (a stale verdict refuses and both revisions are named), 6 (inputStates names what is present with its revision and what is missing), 8 (an unreadable fact refuses).

Not in this step, by design: 5 (the queue hands the card to node.bot) and 7 (the refusal sentence asserted equal to enqueue-guard.mjs) need the fact providers and the shared table of step 2; 9 (hold) and 10 (append-only history) need the card record, and the drawn card is step 3.

Fixes this issue is the pull request's close line; the parent #1272 is opened by the last step.