Authorize allowlisted child workflows with task capability - #92

What

• accept X-Centaur-Workflow-Task-Token on workflow-run creation
• restrict task-authenticated creation to WORKFLOW_API_ALLOWED_NAMES
• keep list, get, cancel, schedules, and events on their existing service/principal authorization lanes
• audit the parent run/task identity for authorized child creation

Why

Scheduled workflow pods intentionally do not inherit WORKFLOW_API_KEY or CENTAUR_CONTROL_API_KEY. They already receive a signed, expiring task capability, but the child-run endpoint did not accept it. That prevented the compliance register updater from durably starting automatic CDD children.

Verification

• cargo fmt --all -- --check
• cargo test -p centaur-api-server workflow_api_tests (10 passed)
• cargo test -p centaur-api-server (153 passed)
• commit 1c27fd7 is GitHub-verified