Deferred: saga compensation, streaming Watch, Nexus, and the smaller carried items

The remaining deferrals from the 2026-08 plan, recorded so they are findable outside docs/plans/.

on_failure: / saga compensation. Deliberately held until inputs:/outputs: existed, since compensation needs values to pass. They exist now (#123), so this is unblocked and is probably the highest-value item on this list — cancellation scopes are what make a half-finished provisioning workload recoverable rather than merely failed.

Streaming Watch RPC. flow watch polls Get. With per-step progress now consumed by the TUI (#131), polling is adequate — a streaming RPC would reduce latency and load but adds a wire surface, so it is worth doing when someone can say which of those they need.

Nexus. Both directions, per ARCHITECTURE.md: a nexus: step consuming another team's operation, and publishing a Flowfile as a Nexus operation — the second being a capability that does not otherwise exist. Multi-week; optional by charter and must never become a prerequisite for local development.

Remote plugin distribution. VISION.md's own words are "not now": OCI artifacts leaning over go-getter, with digests, signing and a local cache. The hooks it would build on (dotted namespace, discovery by explicit path, handshake verification) are already there.

flow test. Blocked on a design question rather than on effort: mocks must not see resolved secrets, and the taint rule for that is unwritten.

Smaller carried items:

• flowstate.proto's Value/literal TODO — "we're using value to represent a literal, which isn't quite the same". The only real TODO in the tree.
• Tree-sitter or TextMate grammar — nothing gives ${...} CEL any highlighting inside YAML today.
• Windows CI — keys.go has a Windows-conditional branch that is never built or tested on Windows.
• renderLiteral in cmd/flow duplicates an unexported value-to-native conversion in pkg/flowstate/v1; collapse it if that conversion is ever exported.
• Per-phase compile spans (parse / CEL compile / validate), if anyone wants finer detail than the RPC span already gives.

Choose one deferred item before starting; read the relevant references in docs/plans/, ARCHITECTURE.md, or VISION.md, then inspect the named entry points such as flowstate.proto, keys.go, cmd/flow, and pkg/flowstate/v1. The issue does not define one shared implementation or completion criterion, so done depends on the selected item and its unresolved design questions.