fix(workflows): stop the drift patch rewriting pinned run prompts [WRO-15b] #4874

Slice 2 of epic #3902. Found while re-measuring that epic on 686df359d; the original decomposition missed it.

WorkflowManager.getWorkflowForRun (lib/workflows/workflow-manager.ts:153) applies the built-in prompt drift patch only when the run is pinned:

const drifted = run.definitionVersion ? patchPinnedBuiltInPromptDrift(raw) : raw;

patchPinnedBuiltInPromptDrift (lib/workflows/built-in-prompt-drift.ts:414) calls resolveBuiltInWorkflowTemplate and rewrites the pinned slot prompts with the current @hyperneo/prompts bytes. So pinning a run is what causes its prompts to track the live package, which inverts the pin's purpose: an unpinned run keeps whatever it was created with, a pinned one is rewritten on every load.

This is the one place a created run deliberately dereferences a mutable source, so it blocks the epic's fourth end-state bullet independently of the reader fallbacks in #3918.

Scope

• Remove the drift patch from the run-load path in getWorkflowForRun.
• Decide where, if anywhere, drift repair still belongs. Repairing a source workflow at author time is defensible; repairing a run is not. If it stays for sources, it moves to the source-read path and not this one.
• Keep sanitizePostApprovalForLoad — it validates against the payload's own nodes and is not a live dereference.

Merge contract

Run-load path only; no schema, no reader-fallback changes (those are #3918). Budgets: ~40 production lines, ~120 test.

Pin first: a test asserting a pinned run's slot prompt survives a change to the built-in template bytes. It should fail on 686df359d.