feat(automation)!: replace event triggers with workflow webhooks

[halfofning]

Summary

• Replace event-trigger APIs, DTOs, persistence, OpenAPI, and worker terminology with workflow webhooks.
• Remove AcornOps Events dispatch while preserving signed webhook security controls.
• Add a forward migration that preserves workflow execution and audit history.

Cross-repo change set

Tracking issue: none.

Related PRs:

• acornops/control-plane#23
• acornops/management-console#23
• acornops/docs-website#15

Merge order:

1. control-plane
2. management-console
3. docs-website

Compatibility: intentional greenfield breaking cleanup; no legacy event-trigger API aliases are retained. Console legacy Runs and Triggers URLs redirect to Activity or the matching Workflows section.

Validation

• npm run validate: 1056/1057 tests passed; blocked by the unrelated baseline test agent-conversations-controller.test.ts (expected read_only, received read_write).
• Targeted workflow webhook validation and PostgreSQL suites passed.
• Migration smoke passed and preserved 3 workflow executions plus 2 audit records.
• npm run typecheck, npm run style:check, migration/authz/membership/run-event checks, npm run contracts:check, npm run openapi:check, npm run harness:check, and npm run build passed separately.
• Changed control-plane and management-console manifest counterparts are semantically identical.

Docs impact

• Updated contract documentation, provenance design notes, manifests, and generated OpenAPI sources.
• Public docs artifact is updated in the related docs-website PR.

Residual risk

• The pre-existing Agent policy test failure prevents a single green control-plane npm run validate result.
• The canonical workspace platform-contract command reads untouched canonical child checkouts; a worktree-aware comparison passed for this changed pair and exposed unrelated existing control-plane ↔ llm-gateway/agentk drift.