Promote request (pending + withdraw)

Deferred to the branch-protection phase. For the first release, promotion is just the existing merge with existing authorization (#4929). This issue adds the promotion request object (pending and withdraw) on top of that later.

As a workflow builder editing in a sandbox, I want Promote to open a review request that stays pending while I keep working, so that my change reaches the live workflow through a PR-style review instead of a direct overwrite, and I can view or withdraw it at any time.

Part of #4852 (Sandbox DevX epic). Builds on Edit in sandbox (#4859).

Outcome

From a sandbox, Promote creates a pending review request. The sandbox stays live and editable while the request is open. The request can be viewed and withdrawn, and it always reflects the latest state of the sandbox.

Acceptance criteria

• Given a sandbox with changes, when I click Promote and submit the review form (change summary plus optional note), then a pending request is created and the header shows a promote pending badge with View request and Withdraw.
• Given a pending request, when I keep editing the sandbox, then the request reflects the latest state (the sandbox stays live and editable).
• Given a pending request, when I Withdraw it, then the workflow returns to the plain sandbox state.

Scope

• WorkflowPromotion schema and migration: workflow_id, source_project_id, target_project_id, status (:pending | :withdrawn | :merged), requested_by_id, reviewed_by_id, note.
• Context (Lightning.Workflows.Promotions): create (pending) and withdraw.
• Promote primary action in the sandbox editor, opening a review form that creates the pending request.
• promote pending state in the header with View request and Withdraw.

Key surfaces

WorkflowPromotion schema and migration, Lightning.Workflows.Promotions, the review form component, the workflow channel, and the editor header.

Estimate

8 story points.