Move bench templates to templates/ and retire workflow-catalog (CL-7373)

[TheGreatAxios]

Resolves CL-7373

Summary

• templates/ at repo root (peer of workflows/): one directory per shipped WorkbenchDefinition (gtm/, code-review/, due-diligence/), a schema + assembled list in templates/index.ts, instantiation (./instantiate) and the template/* settings vocabulary (./settings), and the workflow catalog loader (./catalog) — all as a new @workbench/templates package.
• @workbench/templates/catalog.ts reads assetName/displayName/automatable straight off each workflows/*/package.json corbits.workflow block via a static JSON import (resolved at build time, so it still bundles into the browser) instead of a hand-maintained mirror array. The remaining fields (whatItDoes, requiredConnections, trigger fields, ...) have no npm-visible home of their own and stay hand-authored — there was never a second copy of those to drift.
• The GitHub connect card (connect-github-routes.ts, connect-github-setup.ts) and repo-grant reconciliation move to @workbench/connections, alongside the other connector routes.
• The template-block deploy route and its code-review source builder (hub-only consumers) move into apps/hub/src/templates/.
• packages/workflow-catalog is deleted.

Import path changes

• @corbits/workflow-catalog (root) → @workbench/templates for template/instantiate/settings/catalog symbols (WORKFLOW_CATALOG, isAutomatableWorkflowName, isConversationalWorkflowName, workflowDisplayName, workflowCatalogEntry, deliveryWorkbenchRequiredForWorkflowName, validateTriggerFieldsAtCreate, WorkflowTriggerField, instantiateWorkbenchTemplate, templateSettingsPatch, jimmyAgentRequest/scoutAgentRequest, WORKBENCH_TEMPLATES, GTM_TEMPLATE/CODE_REVIEW_TEMPLATE/DUE_DILIGENCE_TEMPLATE, parseWorkbenchDefinition/serializeWorkbenchDefinition, etc.) — exported names are unchanged, only the module specifier moved.
• @corbits/workflow-catalog/connect-github-routes → @workbench/connections/connect-github-routes
• @corbits/workflow-catalog/template-block-routes → relative import inside apps/hub
• startReviewingRepos/ConnectGithubSetupPorts/webhookTriggerName → @workbench/connections/connect-github-setup
• reconcileDuplicateRepoGrants → @workbench/connections/reconcile-duplicate-repo-grants

Updated: apps/hub, apps/web, packages/agent-directory, packages/evals, packages/routines, packages/settings-ui, packages/chat-ui, packages/chat, packages/hub-client, scripts/db-setup.ts, scripts/checks/error-envelope.ts, and docs (workflows/README.md, docs/GLOSSARY.md, IMPLEMENTATION.md, docs/workflow-detail.md, several workflow/package READMEs). Also dropped two stale unused @corbits/workflow-catalog deps (packages/chat, packages/plugins-ui) that had no real import left.

Net LOC

git diff --shortstat cl-7372-fixture-guard...HEAD: 90 files changed, 805 insertions(+), 738 deletions(-). One package removed (packages/workflow-catalog); one added (@workbench/templates, a plain-data + pure-logic package with no server-only deps).

Deliberately left

• Scope/deploy migration of a template's block workflows is unchanged and out of scope here.
• The report-error baseline was regenerated for the moved files' new paths (bun run scripts/checks/report-error.ts --write-baseline); one pre-existing, unrelated violation in packages/routines-tools/src/tool.ts shows up when diffing locally against origin/main (not touched by this branch) — worth a separate look, not introduced here.

Test plan

• bun run typecheck
• bun run check:licenses
• bun run check:browser-safe-subpaths
• bun run scripts/generate-tsconfig-references.ts --check
• bun test in templates/, packages/connections, packages/agent-directory, packages/chat-ui, packages/hub-client, packages/routines, packages/evals, packages/settings-ui, packages/workflows, apps/hub, apps/web — all pass (DB-gated suites skip locally, as expected without DATABASE_URL)
• apps/web production build (vite build) succeeds, confirming @workbench/templates bundles cleanly into the browser