No way to read a workflow without creating a build

`comfy build from-workflow` is the only verb that reads a workflow file, and it creates a build as a side effect. There is no way to ask what a workflow contains first.

The builder already serves the read-only door. `POST /v1/workflows/resolve` returns the same `definition` and `report` and creates nothing; its own description says it is "for a caller that wants to show a person what the workflow means first". The CLI exposes only the create door.

**Why it matters:** an agent handed an unfamiliar workflow is told to describe what will be created before creating it, and cannot. It has to write a build to find out whether the build is worth writing. On a graph carrying a class nobody publishes, that record is pure litter: the definition comes back `{}` and the right answer is not to build at all.

**Observed**, staging, a workflow with one unpublishable class:

```
$ comfy build from-workflow --from sdxl-with-unknown.json --name probe
{"ok": true, "data": {"build": {"id": "b0fed96c-...", "definition": {},
"workflowImportReport": {"unresolvedClasses": ["TotallyMadeUpNodeXYZ42"], ...}}}}
```

A build now exists that should never have been created, and the only way to have known that was to create it.

**Suggested:** a `comfy build resolve-workflow --from ` (or `--dry-run` on `from-workflow`) that posts to `/v1/workflows/resolve` and prints the report without writing anything.

Found while testing the comfy-build skill's workflow path end to end.