fix(apps): send workflowId not path from CLI; wire sandboxRoot and systemPromptPath in server; update prompts and fixtures

testing/integration/src/test/kotlin/ValidationPipelineIntegrationTest.kt

@@ -14,6 +14,7 @@ import com.correx.core.validation.semantic.rules.CyclePolicyBindingRule
 import com.correx.core.validation.transition.TransitionValidator
 import com.correx.testing.fixtures.CycleFixtures
 import com.correx.testing.fixtures.WorkflowFixtures
+import kotlinx.coroutines.runBlocking
 import org.junit.jupiter.api.Assertions.assertFalse
 import org.junit.jupiter.api.Assertions.assertInstanceOf
 import org.junit.jupiter.api.Test
@@ -34,7 +35,7 @@ class ValidationPipelineIntegrationTest {
     )
 
     @Test
-    fun `full validation pipeline returns NeedsApproval when cycles are unbound`() {
+    fun `full validation pipeline returns NeedsApproval when cycles are unbound`(): Unit = runBlocking {
 
         val graph = WorkflowFixtures.simpleGraph()
 
@@ -52,7 +53,7 @@ class ValidationPipelineIntegrationTest {
     }
 
     @Test
-    fun `rejected outcome retryable is false - set by validator, not orchestrator`() {
+    fun `rejected outcome retryable is false - set by validator, not orchestrator`(): Unit = runBlocking {
         // A dangling transition triggers GraphValidator ERROR → Rejected(retryable=false).
         // Ownership rule: the validator sets retryable; the orchestrator must only read it.
         val a = StageId("A")