feat(executor): add stdin payload transport for script steps

[Jason Robert (jrob5756)]

Summary

Closes#18.

Adds a first-class, cross-platform stdin: field to type: script steps — a raw Jinja2 string template rendered against the workflow context and piped to the child process's stdin as UTF-8. This is the clean, argument-name-agnostic fix for the command-line-length fragility (notably Windows ARG_MAX) that previously forced workflow authors into per-flag temp-file workarounds (--evaluations-file).

- name: summarizetype: scriptcommand: python3args: ["scripts/analyze.py"]stdin: "{{ evaluator.output.evaluations | tojson }}"# JSON via the tojson filter

Why stdin (vs. temp files / arg-spillover)

• No temp-file lifecycle to manage — nothing to clean up.
• process.communicate(input=...) streams stdin in the background while draining stdout/stderr, so multi-MB payloads can't deadlock the pipe or hit ARG_MAX.
• A raw string template is strictly more general than a dedicated stdin_json: JSON is {{ x | tojson }}, arbitrary text (diffs, CSV, prompts) is {{ x }}. Matches how command/args already work.

Behavior contract

• Omitted (stdin: None) → child inherits the parent's stdin (unchanged legacy behavior).
• Present (any string, including "") → stdin is piped; an explicit empty string sends immediate EOF.
• stdin ⟂ args — both are passed when set; no precedence conflict.
• Encoding is UTF-8 (consistent with PYTHONUTF8=1 and the existing stdout/stderr decode).

Changes

• config/schema.py — new stdin field + a single script-exclusive validation guard (mirrors the status/output_template pattern; rejects stdin on all six non-script step types, including agent/human_gate).
• executor/script.py — render + pipe stdin; new ScriptOutput.stdin_bytes.
• engine/workflow.py — script_completed event carries stdin_bytes for dashboard/JSONL observability (never the payload itself).
• Docs/example — docs/workflow-syntax.md, authoring skill reference, NG1 note in the original design doc; new examples/script-stdin.yaml registered in examples/README.md.

Acceptance criteria

• Works uniformly on Windows/macOS/Linux (stdin pipe via asyncio communicate).
• No dependency on argument names.
• Clear precedence when both args and stdin are configured (orthogonal, documented).
• Temp artifact lifecycle deterministic / cleaned up (N/A — no temp files).
• Tests covering large payloads + length behavior.

Tests

• 8 executor unit tests (round-trip, 2 MB payload, empty, omitted back-compat, Jinja render, tojson JSON handoff, stdin+args coexistence, UTF-8 byte count).
• 9 schema tests (accepted on script; rejected on all 6 non-script types).
• 2 engine integration tests (structured payload handoff; 1 MB payload + stdin_bytes event).
• Full sweep: 1811 passed. Lint ✅, typecheck ✅, validate-examples ✅ (23 examples).