refactor(workflow): split @uncaged/workflow-runtime from engine (Phase 1)

Create packages/workflow-runtime with the minimal runtime subset:
- Types (WorkflowFn, RoleOutput, AgentBinding, etc.)
- createWorkflow (pure orchestration, zero I/O)
- validateWorkflowDescriptor
- Result/ok/err, START/END constants

Zero external dependencies (zod as peer only).
Zero node:fs/node:path imports.

Engine (@uncaged/workflow) now depends on workflow-runtime and
provides CAS/merkle/extract implementations via injection.

Refs #121, relates #122

packages/cli-workflow/__tests__/commands.test.ts

@@ -3,7 +3,13 @@ import { mkdir, mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promise
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { getGlobalCasDir, getRegisteredWorkflow, readWorkflowRegistry } from "@uncaged/workflow";
+import {
+  createContentMerkleNode,
+  getGlobalCasDir,
+  getRegisteredWorkflow,
+  readWorkflowRegistry,
+  serializeMerkleNode,
+} from "@uncaged/workflow";
 import { cmdCasGet, cmdCasList, cmdCasPut, cmdCasRm } from "../src/commands/cas/index.js";
 import {
   cmdAdd,
@@ -22,6 +28,10 @@ const fixtureDescriptor = `export const descriptor = { description: "fixture", r
 const wfPutImport = `import { putContentMerkleNode } from "@uncaged/workflow";
 `;
 
+function casStoredForm(raw: string): string {
+  return serializeMerkleNode(createContentMerkleNode(raw));
+}
+
 describe("cli workflow commands", () => {
   let prevEnv: string | undefined;
   let storageRoot: string;
@@ -402,21 +412,23 @@ export const run = async function* (input, options) {
   });
 
   test("cas put/get/list/rm use global cas dir (thread id not required for storage)", async () => {
-    const put = await cmdCasPut(storageRoot, "phase doc");
+    const raw = "phase doc";
+    const stored = casStoredForm(raw);
+    const put = await cmdCasPut(storageRoot, raw);
     expect(put.ok).toBe(true);
     if (!put.ok) {
       return;
     }
     const hash = put.value;
     const blobPath = join(getGlobalCasDir(storageRoot), `${hash}.txt`);
-    expect(await readFile(blobPath, "utf8")).toBe("phase doc");
+    expect(await readFile(blobPath, "utf8")).toBe(stored);
 
     const got = await cmdCasGet(storageRoot, hash);
     expect(got.ok).toBe(true);
     if (!got.ok) {
       return;
     }
-    expect(got.value).toBe("phase doc");
+    expect(got.value).toBe(stored);
 
     const listed = await cmdCasList(storageRoot);
     expect(listed.ok).toBe(true);

packages/cli-workflow/__tests__/serve.test.ts

@@ -1,7 +1,13 @@
 import { describe, expect, test } from "bun:test";
 
+import { createContentMerkleNode, serializeMerkleNode } from "@uncaged/workflow";
+
 import { createApp } from "../src/commands/serve/app.js";
 
+function casStoredForm(raw: string): string {
+  return serializeMerkleNode(createContentMerkleNode(raw));
+}
+
 function buildApp(storageRoot: string) {
   const app = createApp(storageRoot);
   return {
@@ -89,7 +95,7 @@ describe("serve CAS round-trip", () => {
     const getRes = await fetch(`/api/cas/${putBody.hash}`);
     expect(getRes.status).toBe(200);
     const getBody = (await getRes.json()) as { content: string };
-    expect(getBody.content).toBe("hello world");
+    expect(getBody.content).toBe(casStoredForm("hello world"));
 
     // cleanup
     const delRes = await fetch(`/api/cas/${putBody.hash}`, { method: "DELETE" });