Workflows docs show inputs at the workflow root, invalid since 9.5

## Summary

Several Workflows pages show `inputs` at the root of a workflow definition. That has been invalid since 9.5 — kibana#259943 (merged 2026-05-14, `v9.5.0`) moved `inputs` under the `manual` trigger.

Allowed root keys are now `version`, `name`, `description`, `enabled`, `tags`, `triggers`, `settings`, `consts`, `outputs`, `steps` (`kbn-workflows/spec/schema.ts`, `WorkflowSchemaBase`).

Following the docs produces an editor error: `The "inputs" must be defined under a manual trigger, not at the root level.` The workflow can still be saved, but is persisted `valid: false, enabled: false`, so it won't run on triggers and can't be scheduled. Manual runs still work via a runtime backward-compat fallback (`getInputsFromDefinition`).

kibana#259943 carries `release_note:skip`, which is likely why the docs were never updated. Elastic's own SigEvents workflow broke for the same reason (kibana#270116).

## Already correct — use as the model

`authoring-techniques/anatomy.md` handles this properly with an `applies-switch` (9.5+ nested, `stack: preview =9.3, ga =9.4` root-level). Applying the same treatment elsewhere is the fix.

## Affected

Wrong YAML **and** wrong prose:

- `templating.md` — "Inputs are defined at the workflow level"
- `reference/context-variables.md` — "Declared in the workflow's top-level `inputs` block"
- `reference/cheat-sheet.md` — lists `inputs: [ ... ]` among top-level keys

Wrong YAML:

- `triggers/manual-triggers.md` (the page about manual trigger inputs)
- `authoring-techniques/compose-workflows.md`
- `steps/composition.md`
- `use-cases/security/automate-security-operations/enrich-alert-with-threat-intel.md` (×2)
- `use-cases/security/manage-detection-rules/run-rules-on-demand.md` (×2)

## Fix

1. Move `inputs` under the `manual` trigger, scoped with `applies-switch` per `anatomy.md`.
2. Correct the three prose statements above.
3. State that references remain `{{ inputs. }}` in either placement.

## Note

Kibana-side: `get_json_schema_from_yaml_schema.monaco.test.ts` still uses root-level fixtures, but every assertion sits behind `if (!inputsSchema) return;`, so those tests silently no-op.