Advance run-once workflow states

[rochecompaan]

Summary

• Advance patchmill run-once through spec, plan, and implementation workflow states.
• Extract shared spec/plan stage orchestration and artifact helpers.
• Gate existing and newly-created specs/plans on non-stale approval labels.
• Keep spec prompts stage-specific and fail fast on non-ENOENT saved artifact access failures.
• Consolidate approval-state ownership into workflow-state and compress the implementation plan doc.

Verification

• npm run test:run-once
• npm run lint
• npm test
• npm run build
• git diff --check