feat(whaleflow): add Starlark compile gate

Add a fail-closed Starlark authoring layer that compiles workflow files into WorkflowSpec without exposing runtime execution. Include ctx.* repair aliases, unsupported-construct rejection, and rlm_cache_change / issue_fix_tournament examples.

Refs #2670.
Preserves WhaleFlow direction credit for @AdityaVG13 in changelogs and PR notes.

workflows/issue_fix_tournament.star

@@ -0,0 +1,42 @@
+workflow(
+    id = "issue-fix-tournament",
+    goal = "Compare narrow fixes for one issue before promotion",
+    nodes = [
+        branch(
+            id = "candidate-fixes",
+            parallel = True,
+            children = [
+                agent(
+                    id = "minimal-fix",
+                    prompt = "Produce the smallest fix and list verification evidence.",
+                    agent_type = "implementer",
+                    mode = "read_write",
+                    isolation = "worktree",
+                    file_scope = ["crates/**"],
+                ),
+                agent(
+                    id = "defensive-fix",
+                    prompt = "Produce a more defensive fix and list regression risks.",
+                    agent_type = "implementer",
+                    mode = "read_write",
+                    isolation = "worktree",
+                    file_scope = ["crates/**"],
+                ),
+            ],
+        ),
+        sequence(
+            id = "review",
+            children = [
+                tournament(
+                    id = "select-fix",
+                    candidates = ["minimal-fix", "defensive-fix"],
+                ),
+                test(
+                    id = "verify-selected",
+                    command = "cargo test --workspace --locked",
+                    file_scope = ["crates/**"],
+                ),
+            ],
+        ),
+    ],
+)

workflows/rlm_cache_change.star

@@ -0,0 +1,42 @@
+workflow(
+    id = "rlm-cache-change",
+    goal = "Evaluate an RLM/cache routing change with safe mock WhaleFlow IR",
+    nodes = [
+        branch(
+            id = "discover",
+            parallel = True,
+            children = [
+                search(
+                    id = "find-cache-surfaces",
+                    query = "Find RLM and cache routing surfaces",
+                    file_scope = ["crates/tui/src/rlm/**", "crates/tui/src/core/**"],
+                ),
+                agent(
+                    id = "inspect-provider-cache",
+                    prompt = "Inspect provider cache behavior without editing files.",
+                    agent_type = "explore",
+                    file_scope = ["crates/tui/src/providers/**"],
+                ),
+            ],
+        ),
+        sequence(
+            id = "verify-and-summarize",
+            children = [
+                test(
+                    id = "run-rlm-tests",
+                    command = "cargo test -p codewhale-tui rlm --locked",
+                    file_scope = ["crates/tui/src/rlm/**"],
+                ),
+                reduce(
+                    id = "summarize-cache-change",
+                    inputs = [
+                        "find-cache-surfaces",
+                        "inspect-provider-cache",
+                        "run-rlm-tests",
+                    ],
+                    prompt = "Summarize the smallest safe cache-routing patch.",
+                ),
+            ],
+        ),
+    ],
+)