Document workflow_definition access against the native store

[TheGreatAxios]

Summary

CL-7275: workflow_definition is hand-queried 41 times because the shipped
createWorkflowDefinitionStore only covers the (assetId, wireHash)
selector plus the two frozen-version reads. This lane does the first two
checkboxes of that ticket, not the full 41-site migration:

1. Enumerated and categorized the 41 direct drizzle queries against
   workflowDefinition/workflowDefinitionVersion across 14 non-test files
   in apps/ and packages/:

   Category	Count	Shape
   by-id	26	(definitionId, tenantId) lookup
   by-tenant	6	every (deployed) definition for a tenant
   by-name	5	(name, tenantId[, status]) lookup
   by-asset	2	every definition sharing an asset, newest first
   update	2	patch description/status

2. Widened createWorkflowDefinitionStore (vendor/intx/db/src/workflow-definition-store.ts)
   with findById, findByName, listByTenant, listByAsset, and
   updateFields — the five shapes above, all tenant-scoped. Extended the
   vendor/intx/db row in VENDORED.md and its VENDORED-FROM delta note
   rather than adding a new ledger row, and updated the tree-hash kill-date
   record accordingly.

3. Migrated one representative caller per category to prove the surface
   works, with tests (DB-gated where the existing suite already was; fake-db
   fixtures updated to full row shapes where the store's row-validation now
   runs on them):

   • by-id: workflow-capability-routes.ts's self-capability route
   • by-tenant: visible-definitions.ts's ancestor-chain listing
   • by-name: resolve-myra-definition-id.ts (new DB-gated suite)
   • by-asset: agent-workflow.ts's duplicate-handle recovery check
   • update: routes.ts's PUT /:definitionId/status route

The remaining ~36 call sites are unchanged; migrating them all is out of
scope for this lane per the ticket's own sequencing.

Test plan

• bun run typecheck in vendor/intx/db and packages/agent-directory
• bun test in vendor/intx/db (new DB-gated suite, real Postgres)
• bun test in packages/agent-directory (193 tests, all green)
• bun run check:killdates
• WORKBENCH_CHECK_SINCE=origin/main bun run check (narrowed) — green
  aside from two pre-existing failures unrelated to this change
  (@corbits/tool-registry-publish's freshness-check test hitting a
  local git-hook author-allowlist, and a flaky @corbits/chat run under
  heavy concurrent load — both green in isolation)

[TheGreatAxios]

Consolidated into #531 — four independent docs files merging as one CI cycle rather than four serialized ones under strict branch protection. Content unchanged.