feat(kernel): read-only mode after read-before-write + mandatory task-decompose gate

Two orchestrator tool-gating behaviors (both touch SessionOrchestrator):

- Read-only switch: when a tool call is BLOCKed with READ_BEFORE_WRITE, derive a
  read-only mode from the event log (block until a later FILE_READ completes) and
  withhold FILE_WRITE tools from the next inference turn(s), so a weak model is
  pushed down the read-then-write path instead of looping on the blocked write.
- require_task_decompose stage flag (TomlWorkflowLoader) + owesTaskDecompose guard:
  a stage so marked cannot stage_complete until a task_decompose/task_create has
  succeeded this stage. New task_planning workflow + prompt are the first consumer
  (decompose-only: swoop codebase, emit a parent + DEPENDS_ON task graph, stop).

infrastructure/workflow/src/main/kotlin/com/correx/infrastructure/workflow/TomlWorkflowLoader.kt

@@ -49,6 +49,7 @@ private data class StageSection(
     @param:JsonProperty("inject_artifact_kinds") val injectArtifactKinds: Boolean = false,
     @param:JsonProperty("ground_references") val groundReferences: Boolean = false,
     @param:JsonProperty("brief_echo") val briefEcho: Boolean = false,
+    @param:JsonProperty("require_task_decompose") val requireTaskDecompose: Boolean = false,
 )
 
 // condition fields flattened into the transition row
@@ -125,6 +126,7 @@ class TomlWorkflowLoader(
                     if (s.injectArtifactKinds) put("injectArtifactKinds", "true")
                     if (s.groundReferences) put("groundReferences", "true")
                     if (s.briefEcho) put("briefEcho", "true")
+                    if (s.requireTaskDecompose) put("requireTaskDecompose", "true")
                 },
             )
         }