Delivery: integrate all workflows with controller and one-shot packets

[Wibias]

Stack

PR 5 of the v0.5.0 reliability/convergence rewrite. Stacked on PR #226.

Scope

• map every routed GitHub Delivery workflow to an explicit controller graph
• add a one-shot workflow packet that resolves selected workflow + unconditional policy once
• load conditional policy only when explicitly activated by an observable condition
• add persistent controller CLI for start/transition/cycle/retry/evidence/usage/ref/blocker operations
• make the controller the universal execution contract for routed workflows
• prevent read-only workflows from drifting into mutation phases

TDD status

This PR begins with profile/packet coverage tests across every routed workflow.

Stack contract

PR 6 will replay the real incidents plus adversarial and false-positive corpora and set quantitative budgets. v0.5.0 remains blocked until those gates pass.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.