two-level expansion model

Key features

• One source of truthAgent, Engine and Canvas all read and write WorkflowTemplate, and no longer maintain a second set of Canvas DSL.
• The exact revision must be specified when running a release build.
• Exact resolutionNodes use type@version, and post-release Workflows and sub-processes are fixed to immutable revisions.
• Ability does not exceed authority: dsh.tool@1, dsh.agent@1, dsh.human-approval@1 always go through the tool, subagent, approval and owning Agent of the current DSH scope.