feat: workflow as a valid default export

[Copilot]

SKILL.md only documented agent as the valid root export, and the launcher only handled AgentFn, strings, and PromptBuilder — exporting a workflow would silently error.

Changes

• Launcher (skills/rig/rig.ts): Added isWorkflow() type guard; asRootProgram() now wraps a Workflow default export in runWorkflow automatically — no manual call needed in the program file. No-input workflows use the string schema so inline mode works unchanged.
• SKILL.md: Rules 1, 2, 7 updated; new "Deterministic TypeScript fan-out" row in the decisions table; "Runnable output" and "Final check" updated to name both agent and workflow as valid roots; // Workflow role: convention introduced alongside // Agent role:.
• references/dynamic-workflows.md: Added "Workflow as default export" section with a worked example and the decision rule — workflow when TypeScript owns the orchestration, agent + agents: when the LLM should improvise the order.
• samples/60-workflow-parallel-linter.md: New 24-line sample showing workflow as root — discovers files via call.text(), fans out with pipeline.

// Workflow role: discover and lint TypeScript source files in parallel.
const linter = workflow({
  meta: { name: "linter", description: "Lint TypeScript files in parallel", phases: ["Discover", "Lint"] },
  body: async ({ call, phase, pipeline }) => {
    phase("Discover");
    const raw = await call.text("List TypeScript source files to lint, one path per line.");
    const files = (raw ?? "").split("\n").map((f) => f.trim()).filter(Boolean);
    phase("Lint");
    return pipeline(files, (file) => call(lintFile, { file }, { label: file }));
  },
});

export default linter; // launcher calls runWorkflow(linter, ...) automatically