Workflows

Remediation playbooks. Workflows graduate draft → approved → auto as their eval scores accrue; auto-execution can be killed per-workflow at any time. Every trigger evaluates the governance policies before any executor mutation.