Unified reflow CLI: run, workspace, peer, discovery, trace, serve

[darmie]

A single reflow binary over the existing runtime APIs, so graph execution,
multi-graph workspaces, distributed peers, and tracing share one entry point
instead of a scattered set of binaries (reflow-peer, reflow-discovery,
reflow_server). New crate crates/reflow_cli ([[bin]] reflow).

Command tree

reflow run <graph.json> [--pack <p>…] [--trace] [--trace-server ws://…] [--trace-tail]
reflow graph validate|inspect <graph.json>
reflow workspace discover|list|namespaces|analyze|compose [-o]|run <dir>
reflow peer spawn <peer.toml> [--send net:actor:port:text]
reflow discovery serve [--bind] [--entry-ttl-secs] [--prune-interval-secs]
reflow trace serve [--config] | tail | query | get <id>
reflow serve [--port] [--bind] [--redis <url>]

Highlights

• run loads a graph, resolves each component against the bundled
  reflow_components catalog (+ --pack packs, mirroring the C-ABI
  rfl_template_actor_new), builds the Network, starts it, and runs until
  Ctrl-C. --trace* wires tracing and streams live events via the local tap.
• workspace reuses WorkspaceDiscovery + GraphComposer; workspace run
  composes then executes through the same shared runtime::run_graph_export.
• peer/discovery absorb the old binaries. The peer logic moved into
  reflow_distributed::peer::run_peer, so reflow-peer is now a thin shim and
  reflow peer spawn drives the exact same code.
• trace runs the collector (reflow_tracing::TraceServer) and consumes
  via TracingClient (tail/query/get).

Whole CLI: Zeal made optional, serve runs in-process

serve previously couldn't link reflow_server because of its out-of-tree
zeal-sdk path dep, so it shelled out to a separate binary. This PR makes Zeal
opt-in so the server core links cleanly:

• zeal-sdk is now optional = true behind a zeal feature, default = ["zeal"] — the standalone reflow_server binary and existing Zeal users are
  unchanged. The CLI links it with default-features = false.
• Zeal-only modules, start_zeal_execution, /zeal/* routes+handlers, and the
  Zeal branch of start_server are feature-gated. EventBridge stays in both
  configs (no-op attach drains the channel when Zeal is off).
• zeal-sdk is a pinned git dep (offbit-ai/zeal), not a path. Because it's
  optional and unused by the workspace, it never enters Cargo.lock or the
  resolve graph — workspace builds and maturin need no Zeal checkout; it's
  fetched only when reflow_server is built with --features zeal.
• reflow serve calls reflow_server::start_server in-process, mapping
  --port/--bind/--redis onto ServerConfig.
• Fixed a pre-existing startup panic affecting both server configs: the
  /webhook/{id}/{path:.*} route used regex syntax axum 0.7 rejects, so the
  server panicked on boot. The route never functioned and is removed;
  /webhook/{id} is unaffected.

CI

.github/workflows/release-cli.yml builds the reflow binary for five targets
on native runners (incl. arm64 Linux — native-tls/OpenSSL doesn't cross-compile
cleanly) and attaches per-target archives to a Release on cli-v* tags;
workflow_dispatch builds all targets without releasing.

Verification

• reflow run loads/resolves/starts a fixture graph; graph validate/inspect
  and workspace discover/list work against the example workspace.
• reflow serve answers GET /health 200 in-process.
• reflow_server builds with and without zeal; CLI integration tests
  pass (3/3); cargo metadata resolves with no Zeal checkout.
• Release build of the host target produces a working reflow 0.2.0.

Follow-ups: script-actor resolution in run (needs async runtime setup),
distributed-graph composition across peers beyond peer spawn.