Add a fail-closed Starlark authoring layer that compiles workflow files into WorkflowSpec without exposing runtime execution. Include ctx.* repair aliases, unsupported-construct rejection, and rlm_cache_change / issue_fix_tournament examples.
Refs #2670.
Preserves WhaleFlow direction credit for @AdityaVG13 in changelogs and PR notes.