feat(workflows): owner-reviewed agent draft-create (mirror agents draft-create)

## Problem

Agents can `buzz workflows create`, but the resulting kind:30620 is **agent-signed**. That breaks the human ownership model:

- Desktop Workflows management expects owner-controlled defs (delete/update auth is author-scoped — see #2671).
- Humans should never hand agents their private key so an agent can \"create as me.\"
- Tonight's ECN #marketing incident: CLI showed agent workflows; Desktop showed empty; schedule never proven for agent defs.

Same class of problem as agent creation (solved) and repository creation (#5052).

## Proposed solution

Mirror `buzz agents draft-create` / #5052:

1. `buzz workflows draft-create --channel --yaml ` (requires `BUZZ_AUTH_TAG`)
2. Optional: `buzz workflows draft-update --channel --workflow --yaml ...`
3. Owner-encrypted observer frame `workflow_management_request` → Desktop opens Create/Edit Workflow dialog
4. Owner **Save** signs kind:30620 with the **human** key; Cancel = no event

Do **not** reuse `workflows approve` (that is run-step `request_approval`).

Keep raw `workflows create` for power users; teach ACP to prefer draft-create for agent-proposed defs.

## Acceptance criteria

- [ ] Agent with `BUZZ_AUTH_TAG` can open an owner-reviewed workflow draft; missing tag → clear auth error
- [ ] Save produces kind:30620 whose pubkey is the reviewing human (test asserts), not the proposing agent
- [ ] Cancel produces no workflow event
- [ ] Invalid YAML / channel UUID rejected with a clear error
- [ ] ACP base prompt + sprout-cli skills document `workflows draft-create`
- [ ] Raw `workflows create` still works (no break)

## Related

- Pattern: `crates/buzz-cli/src/agent_management.rs`, `desktop/.../agentManagement.ts`
- Sibling list-empty bugs (do not block this PR): #2385, #4419, #4804, #4696
- Undeletable agent workflows: #2671
- Repos analogue: #5052

## Context

Requested from ECN nest / Buzz Desktop 0.5.5 on hosted community relay while setting up a nightly LinkedIn content workflow.

Start with crates/buzz-cli/src/agent_management.rs and desktop/.../agentManagement.ts to trace the existing agent draft-create flow, then inspect the ACP base prompt and sprout-cli skills references. Done means owner-reviewed workflow drafts support create and optional update, enforce BUZZ_AUTH_TAG and input validation, sign saved kind:30620 events with the human key, leave no event on cancel, and preserve raw workflows create.

Written by the indexing model from the issue text.