Show ingress change categories in workflow summaries

[cbusillo]

Summary

• show ingress operation change_categories in dry-run and canary apply workflow summaries
• default missing or empty categories to none for old/no-op responses
• pin the display behavior in workflow contract tests

Tests

• uv run python -m unittest tests.test_product_onboarding
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run --extra dev ruff format --check tests/test_product_onboarding.py
• uv run --extra dev mypy tests/test_product_onboarding.py
• git diff --check
• manual jq summary smoke with categorized and uncategorized operations

Agent review: 2 read-only agents reported no blocking findings.