feat(workflows): owner-reviewed agent draft-create (mirror agents draft-create)

[serenelion]

Problem

Agents can buzz workflows create, but the resulting kind:30620 is agent-signed. That breaks the human ownership model:

• Desktop Workflows management expects owner-controlled defs (delete/update auth is author-scoped — see [Bug] Workflow deletes from Desktop are addressed at the caller, not the workflow's author — agent-created workflows are undeletable #2671).
• Humans should never hand agents their private key so an agent can "create as me."
• Tonight's ECN #marketing incident: CLI showed agent workflows; Desktop showed empty; schedule never proven for agent defs.

Same class of problem as agent creation (solved) and repository creation (#5052).

Proposed solution

Mirror buzz agents draft-create / #5052:

1. buzz workflows draft-create --channel <uuid> --yaml <definition|-> (requires BUZZ_AUTH_TAG)
2. Optional: buzz workflows draft-update --channel <uuid> --workflow <uuid> --yaml ...
3. Owner-encrypted observer frame workflow_management_request → Desktop opens Create/Edit Workflow dialog
4. Owner Save signs kind:30620 with the human key; Cancel = no event

Do not reuse workflows approve (that is run-step request_approval).

Keep raw workflows create for power users; teach ACP to prefer draft-create for agent-proposed defs.

Acceptance criteria

• Agent with BUZZ_AUTH_TAG can open an owner-reviewed workflow draft; missing tag → clear auth error
• Save produces kind:30620 whose pubkey is the reviewing human (test asserts), not the proposing agent
• Cancel produces no workflow event
• Invalid YAML / channel UUID rejected with a clear error
• ACP base prompt + sprout-cli skills document workflows draft-create
• Raw workflows create still works (no break)

Related

• Pattern: crates/buzz-cli/src/agent_management.rs, desktop/.../agentManagement.ts
• Sibling list-empty bugs (do not block this PR): relay: multi-value #h filters collapse to lexicographically-first channel (Workflows overview shows empty) #2385, Desktop Workflows view shows empty despite channel workflows returned by relay #4419, Workflows list returns empty for any account with more than one channel #4804, Desktop Workflows list empty on hosted community (0.5.3) while kind 30620 + schedule still live #4696
• Undeletable agent workflows: [Bug] Workflow deletes from Desktop are addressed at the caller, not the workflow's author — agent-created workflows are undeletable #2671
• Repos analogue: Add owner-signed repository creation to Desktop and agent draft flow #5052

Context

Requested from ECN nest / Buzz Desktop 0.5.5 on hosted community relay while setting up a nightly LinkedIn content workflow.