chore: internalize unused exports across all packages

Audit public API surfaces using reachability analysis from application
entry points (Worker, CLI, Dashboard). Symbols not reachable from any
application's customization tree are removed from package index.ts files.

Source files and internal usage are untouched — only the public export
surface is narrowed.

Changes by package:
- workflow-util: -7 exports (base32 internals, logger config types)
- workflow-cas: -12 exports (merkle internals, serialization details)
- workflow-execute: -24 exports (engine internals, LLM extract details)
- workflow-reactor: -4 exports (reactor config/invocation internals)
- workflow-register: -8 exports (redundant protocol re-exports, internal YAML fns)
- workflow-runtime: curated re-export subset (stop full protocol re-export)
- workflow-util-agent: -5 exports (internal agent helpers)
- workflow-agent-cursor: -1 export (validateCursorAgentConfig)
- workflow-agent-hermes: -1 export (validateHermesAgentConfig)

Note: workflow-protocol index.ts unchanged — downstream packages still
import removed symbols via internal paths. Protocol cleanup requires
updating workflow-runtime/src/types.ts first (separate PR).

Refs #273, #274, #275, #276, #277, #278, #279, #280, #281, #282

packages/workflow-util-agent/src/index.ts

@@ -1,5 +1,4 @@
-export { buildAgentPrompt, buildThreadInput } from "./build-agent-prompt.js";
-export type { ExtractOptionsFn } from "./create-agent-adapter.js";
-export { createAgentAdapter, createSimpleAgentAdapter } from "./create-agent-adapter.js";
-export type { SpawnCliConfig, SpawnCliError, SpawnCliResult } from "./spawn-cli.js";
+export { buildThreadInput } from "./build-agent-prompt.js";
+export { createAgentAdapter } from "./create-agent-adapter.js";
+export type { SpawnCliError } from "./spawn-cli.js";
 export { spawnCli } from "./spawn-cli.js";