Add authenticated durable workflow delivery API

[loganj]

🤖 Larry here.

Summary

• Gives a managed agent an authenticated, durable way to claim one workflow message, keep its lease alive, and report the outcome without exposing private workflow inputs.
• Adds a relay-signed receipt proving which workflow revision, run, step, trigger, target, and visible message the delivery belongs to.

Details

• Every read or mutation requires a fresh signed HTTP request from the delivery's exact target agent.
• Claim, read, renew, and finish reject the wrong workspace, target, workflow/run/step binding, lease generation, expired lease, or conflicting terminal replay.
• The claimed delivery includes the exact signed workflow definition, visible message, and a relay-signed verification receipt. The receipt carries only public references and a hash of the visible message; it never contains trigger context, webhook fields, prior-step outputs, execution traces, or secrets.
• Receipt issuance revalidates the trigger against durable authority. Scheduled runs must match their claimed schedule slot, event-triggered runs must reference an existing signed event, and webhook runs use a payload-free invocation record bound to the workspace, workflow, and run.
• The webhook authority schema is additive for existing deployments.

Scope

This draft remains dormant. It adds no delivery producer, automatic poller, ACP dispatch, or production activation; those stay in later dependent changes.