Feat v0.3.3 public entry + background jobs

Public workflow entry: unauthenticated routes at /api/v1/public/workflows/
for anonymous workflow participation. StartPublic creates instances with
public:<uuid> identity, ResumePublic/AdvancePublic use entry tokens.
Audience-gated: only public stages can be advanced anonymously.

SLA scanner: background goroutine (5-min interval) checks active instances
against per-stage sla_seconds. Fires workflow.sla_breach event on first
breach, marks sla_breached in instance metadata (idempotent).

Staleness sweep: new staleness_timeout_hours column on workflows. Scanner
marks idle instances as stale, cancels open assignments, fires
workflow.stale event.

New store methods: ListActiveInstances, MarkInstanceStale.
New events: workflow.sla_breach, workflow.stale.
3 new store tests (17 total), all passing on SQLite.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -359,6 +359,24 @@ func main() {
 		api.POST("/hooks/:package_id/:slug", triggerEngine.HandleWebhook)
 		api.GET("/hooks/:package_id/:slug", triggerEngine.HandleWebhook)
 
+		// ── Workflow Engine (shared by public + protected routes) ──
+		wfEngine := workflow.NewEngine(stores, bus, starlarkRunner)
+
+		// ── Public Workflow Entry (v0.3.3) ─────
+		publicWfH := handlers.NewWorkflowPublicHandler(wfEngine, stores)
+		publicWf := api.Group("/public/workflows")
+		publicWf.Use(authLimiter.Limit())
+		{
+			publicWf.POST("/:id/start", publicWfH.StartPublic)
+			publicWf.GET("/resume/:token", publicWfH.ResumePublic)
+			publicWf.POST("/advance/:token", publicWfH.AdvancePublic)
+		}
+
+		// ── Workflow Scanner (v0.3.3) ──────────
+		wfScanner := workflow.NewScanner(stores, bus)
+		wfScanner.Start()
+		defer wfScanner.Stop()
+
 		// ── Protected routes ────────────────────
 		protected := api.Group("")
 		protected.Use(middleware.Auth(cfg, stores.Users, userCache))
@@ -401,7 +419,6 @@ func main() {
 			protected.GET("/workflows/:id/versions/:version", wfH.GetVersion)
 
 			// Workflow instances + assignments (v0.3.2)
-			wfEngine := workflow.NewEngine(stores, bus, starlarkRunner)
 			wfInstH := handlers.NewWorkflowInstanceHandler(wfEngine, stores)
 			protected.POST("/workflows/:id/instances", middleware.RequirePermission(auth.PermWorkflowSubmit, stores), wfInstH.Start)
 			protected.GET("/workflows/:id/instances", wfInstH.ListInstances)