Deterministic Workflow orchestration over Pixir Subagents.

A Workflow is a bounded plan of steps with explicit dependency edges and write-set metadata. Ordinary steps schedule ADR 0011 Subagents; explicit virtual_overlay steps run the internal BEAM-native virtual workspace runner and return virtual_diff evidence without opening a child Session or mutating the parent workspace.

The module also exposes non-executing dependency-wave critical-path estimation for Delegate admission, reusing the same normalization and wave planner as dry-run and runtime scheduling.

The top-level Workflow result has a narrow terminal contract: "completed" means every step produced a dependent-safe checkpoint, while "partial" means at least one step needs retry, synthesis, inspection, or orchestrator input. Step-level checkpoint_status values carry the detailed truth ("held", "failed", "partial", "needs_orchestrator", or "checkpoint_ready").

Dependents unlock only from "checkpoint_ready", with two explicit carve-outs: an apply step consumes its apply_from producer at any status, and a step may name a subset of its own depends_on in allow_unverified_depends_on to also admit a dependency whose child completed successfully but derived "partial" — the shell-less-writer-plus-audit shape. That opt-in is per-step and per-dependency, never global and never a default, and a step admitted through it records verification.unverified_dependencies and the "ran_against_unverified_dependencies" known limitation in its own checkpoint.

TODO(delegate-service-v1)

Delegate service mode will eventually need a Workflow strategy, but it should not bypass this module's checkpoint and partial-outcome vocabulary. Prefer a thin Delegate adapter that submits a normalized Workflow spec here, then reports workflow_id, child ids, checkpoint readiness, and safe next actions through the same delegate status/attach contract used for Subagent fanout.