Feat v0.9.7 workflow starlark write ops

Add workflow.start(), workflow.advance(), workflow.cancel(), and
workflow.submit_signoff() to the Starlark workflow module. Extract
WorkflowEngine interface in sandbox package to break the circular
import between workflow and sandbox packages.

- WorkflowEngine interface (Start/Advance/Cancel/SubmitSignoff)
- instanceToDict/signoffToDict/dictToJSON shared helpers
- Runner.SetWorkflowEngine setter + main.go wiring
- 6 new unit tests with mock engine

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -129,11 +129,13 @@ Manifest `form_template` accepted at package level. 16 new tests.
 "review" mapped to "form" on input; review surface removed (~110 lines).
 Migration 018. 4 package manifests updated.
 
-**v0.9.7 — Full Read/Write Workflow Starlark Module**
+**v0.9.7 — Full Read/Write Workflow Starlark Module** *(completed)*
 
-Add `workflow.start()`, `workflow.advance()`, `workflow.cancel()`,
-`workflow.submit_signoff()` to the Starlark module. Extract engine
-interface to break circular import.
+`WorkflowEngine` interface extracted in sandbox package to break
+circular import. Four write builtins added: `workflow.start()`,
+`workflow.advance()`, `workflow.cancel()`, `workflow.submit_signoff()`.
+`instanceToDict` and `signoffToDict` helpers shared by read+write paths.
+6 new tests.
 
 **v0.9.8 — Conditional Routing → SDK Primitive**