fix: gate the workflow configure path on category-level feature flags

Follow-up from #1706 (review thread on `WorkflowGate`).

## Problem

`WorkflowGate` gates the configure path on the workflow's **own** feature flags (`hyphy`, `lmls`) via `isWorkflowAllowed`. It cannot apply the **category-level** gate (`ASSEMBLY` → `assembly-workflows`), because that rule lives in `filterCategories` and needs a category object — and the gate is only ever handed a TRS ID.

`WorkflowGate` is the sole gate on all four configure pages, with no category wrapper above it:

- `sites/brc-analytics/pages/data/assemblies/[entityId]/analyze/workflows.tsx`
- `sites/brc-analytics/pages/data/organisms/[entityId]/analyze/workflows.tsx`
- `sites/ga2/pages/data/assemblies/[entityId]/analyze/workflows.tsx`
- `sites/ga2/pages/data/organisms/[entityId]/analyze/workflows.tsx`

So with `assembly-workflows` off (the prod default), opening an Assembly workflow's configure URL directly — e.g. `/data/assemblies//analyze/workflows?trsId=<...>/polish-with-long-reads/main/versions/v0.1` — renders the full configure-and-launch view and lets the user launch into Galaxy, even though the Assembly category is hidden in every listing (`getWorkflows`, `buildAssemblyWorkflows`, `WorkflowsSection`). The two ORGANISM-scoped Assembly workflows are reachable the same way via the organism configure URL.

Pre-existing rather than introduced by #1706 — before it, `WorkflowGate` did no flag gating at all and all three flags leaked here. #1706 closed the two workflow-level ones and documented the remaining limit in the gate's JSDoc.

## Proposed change

Make the category gate resolvable from workflow identity, so a single call gates both levels:

- Add a `feature_flag` slot to the workflow catalog schema, so a workflow carries its own gate rather than inheriting one from a category the runtime has to look up. `isWorkflowAllowed` then answers for both levels and `WorkflowGate` needs no extra lookup.
- Alternative if the schema change isn't wanted: resolve the workflow's category from the categories store inside `WorkflowGate` and apply `isWorkflowCategoryEnabled` too. Cheaper, but adds a second store read to a component that currently needs only the workflows cache.

## Acceptance criteria

- [ ] With `assembly-workflows` off, the configure URL for an Assembly workflow renders the not-found fallback on all four configure pages.
- [ ] Category-level and workflow-level gating are answered through one call, so a caller can't apply half the rule.
- [ ] The `WorkflowGate` JSDoc limitation note is removed once the gap is closed.