Workflow engine step 2: the repo-dev preset and the fact providers #1294

Written-by: Dev3
Part of #1272 — step 2. One child issue per step; the PR for this step carries Fixes #<this issue>.

Scope

1. The four step-2 debts both reviewers named on feat(workflow): nodes, artifacts and the flowchart as data (#1272 step 1) #1291 (not optional; a and b are prerequisites for the preset writing facts):
   • normaliseGuard must refuse an unknown is instead of silently downgrading it to present.
   • producersOf/consumersOf must key on the parsed spec, not the raw string (text: draft vs text:draft).
   • One word for one thing: role, not bot (holderOf, preset, docs together).
   • resolvedEdges reports one field for one value, not artifact and carries.
2. core/src/shared/workflow-repo-dev.js: the seven nodes of the The workflow engine: each node names its Bot and its inputs and outputs, the nodes are drawn as a flowchart, and a node missing an input is refused on the card #1272 table (triage/build/verify/review/gate/merge/release), each with role, inputs, outputs, guards, refusal.
3. Each preset node carries a column (not-started | in-progress | done; false draws no column), review and done-today fall to false. workflowColumns() honours it; a definition without the attribute keeps the old behaviour (the 19 step-1 tests must not go red). This is the One board: the delivery board and the task board are one board, and a repository task is its issue #1265 rule: review is a PR state, not a third lane.
4. core/src/host/workflow-facts.js: one function per fact (github.labels, github.checkAtSha, github.verdictAtTip, github.mergeable, github.prBodyTip, task.progress, manual.tick). No GITHUB_TOKEN or no answer means unreadable, never a guess (acceptance 10).
5. .github/scripts/fixtures/workflow-cases.json: the shared case table that enqueue-guard.mjs, merge-gate.mjs and the preset tests all read; nobody imports anybody.

Acceptance

• Each of the four debts gets its own sentence and its own test, plus a knife for a and b.
• Acceptance 9 is asserted for real: for the same input the preset's guard sentence and the sentence enqueue-guard.mjs emits are byte-equal.
• Acceptance 10: an unreadable fact refuses; nothing passes on a guess.
• node scripts/ds-bot-patches.mjs check passes on the tip (three lines), with the new files mirrored under patches/ds-bot/.
• No user-visible surface this step, so no changelog fragment.
• Not touched: delivery-board.js / delivery-view.js (Dev4 holds them for One board: the delivery board and the task board are one board, and a repository task is its issue #1265 step 4), column folding, the Workflows page (step 3), the scheduler.