Revise Puber workflow waiting states

[rovkinmax]

Summary

• replace terminal/retry blockers with approval-gated needs_user_action self-loops and explicit wont_do cancellations
• add waiting_pr semantics so PR workflows only reach done after merged PR + cleanup
• tighten physical-device rules to require explicit permission plus explicit serial
• update workflow snapshots, project contract, AGENTS, and command contracts away from old done/blocked transitions

Verification

• kent workflow validate --mode execution for all 9 Puber workflows
• no live Puber transition groups named blocked/retry_later/not_ready
• snapshots parse with jq
• compliance_reviewer follow-up: No blocking findings