Workflow publish rejects valid Agent V2 workspace Skill references

## Summary

Publishing a workflow fails when an Agent V2 node's system prompt references a workspace Skill that is validly bound to the Agent's published snapshot.

## Steps to reproduce

1. Create and publish a workspace Skill, for example `pai-diagnosis`.
2. Bind it to an Agent V2 roster agent.
3. Reference it in the Agent system prompt, for example `[§skill:pai-diagnosis:Pai Diagnosis§]`.
4. Publish the Agent so the Skill binding is captured in `agent_skill_binding_snapshots`.
5. Add the Agent to a workflow and publish the workflow.

## Expected behavior

The workflow publishes successfully because the referenced workspace Skill is bound to the selected Agent snapshot and is available at runtime.

## Actual behavior

The publish request returns HTTP 400:

```json
{
"code": "invalid_param",
"message": "Workflow Agent node has invalid Agent Soul config refs: skill_ref_dangling: skill 'Pai Diagnosis' is not configured.",
"status": 400
}
```

## Root cause

`WorkflowAgentPublishService._require_config_asset_refs_resolved_for_publish` validates Skill mentions only against embedded `agent_soul.config_skills`. It does not include workspace Skills from `AgentSkillBindingSnapshot`, although runtime Skill loading supports those snapshot bindings.

This makes publish-time validation inconsistent with runtime behavior.

## Environment

Observed on Dify 1.17.1.

Start at WorkflowAgentPublishService._require_config_asset_refs_resolved_for_publish and trace how AgentSkillBindingSnapshot data is represented during workflow publishing. Compare the publish-time Skill reference check with runtime snapshot binding behavior, then add coverage showing a valid workspace Skill reference allows publication and run the relevant workflow publish tests.

Written by the indexing model from the issue text.