feat(router): emit structured workflow proposals from triage

The triage system prompt now appends a fenced json propose_workflows block;
WorkflowProposals.parse strips it from the visible chat turn and onUserInput
records a WorkflowProposedEvent (CHAT only). Candidate ids are validated against
the registered workflows (invariant #7) so an invented id never reaches the
operator. Bumped a token-budget test for the larger prompt.

testing/deterministic/src/test/kotlin/RouterContextBuilderTest.kt

@@ -129,9 +129,10 @@ class RouterContextBuilderTest {
                 RouterTurn(TurnRole.ROUTER, longContent, Instant.parse("2026-01-04T00:00:00Z")),
             ),
         )
-        // Budget allows L0 + 2 long conversation turns; oldest 2 turns are dropped
-        // Budget increased from 500 to 600 to account for larger system prompt with triage directive
-        val pack = runBlocking { builderWide.build(state, TokenBudget(limit = 600)) }
+        // Budget allows L0 + 2 long conversation turns; oldest 2 turns are dropped.
+        // Bumped 500 → 600 → 800 as the triage system prompt grew (now carries the
+        // workflow-proposal directive); conversationKeepLast=2 still caps L1 at 2.
+        val pack = runBlocking { builderWide.build(state, TokenBudget(limit = 800)) }
         val l1Entries = pack.layers[ContextLayer.L1] ?: emptyList()
         // Only the last 2 turns (oldest-first drop) should remain
         assertEquals(2, l1Entries.size)