workflow, subagent: fix Codex code-review round-1 blockers

Six verified A-findings from the code-stage review, each with a regression test:

- parallel()/pipeline() resolved to HOST arrays inside the vm realm, exposing
  host Array.prototype to scripts; combinator results are now realm-built
  (in-realm Array.from bound at context setup).
- materializeFromRealm ran proxy traps (ownKeys/getOwnPropertyDescriptor/
  getPrototypeOf) during the descriptor walk — realm code on the host stack,
  outside the vm timeout, escaping as raw errors; proxies (root, nested, and
  in the prototype position) are now rejected trap-free via util.types.isProxy
  before any inspection.
- an already-aborted signal or an immediate cancel() no longer reports
  'completed' for a hook-free script: drive() checks cancellation before
  running the body and again when the script settles.
- dispose() now waits (bounded by disposeGraceMs) for stray agent() children
  to FINISH disposing, not just for the script to settle: every agent() call
  is tracked and quiesce() drains the in-flight set.
- workflow/* event payloads were live mutable aliases shared across emissions;
  emitWorkflowEvent now hands each listener its own structural clone.
- the structured-output turn-continuation veto is now prepend: true, so an
  earlier-registered force-continue listener cannot short-circuit it.

Docs updated in the same change (READMEs, core-data-structures/workflow.md,
the dynamic-workflows RFC, regenerated cordis catalogs).

packages/workflow/workflow/src/index.ts

@@ -13,8 +13,10 @@
  * carry {@link WorkflowRunInfo} (id + meta), never the live {@link WorkflowRun}
  * — a listener must not gain `cancel`/`dispose`; control stays with the
  * `start()` caller holding the run. Every emit is per-listener contained (a
- * throwing subscriber is logged, never propagated), so one bad observer can
- * neither strand a live run nor starve later listeners.
+ * throwing subscriber is logged, never propagated) and every listener gets its
+ * own payload clone (mutating it corrupts nothing), so one bad observer can
+ * neither strand a live run, starve later listeners, nor poison another
+ * listener's view.
  *
  * @module @deepseek-ai/dsh-workflow
  */
@@ -182,8 +184,9 @@ export function isFatalWorkflowError(error: unknown): boolean {
  *   snapshots, per-listener containment); `workflow/end` fires exactly once
  *   per started run, after `result` is settled or as it settles.
  * - `dispose()` reaches quiescence within a bounded grace: it cancels, waits
- *   for the script to settle, and abandons a stuck script rather than
- *   hanging its caller (the engine documents what abandonment leaves behind).
+ *   for the script to settle AND its started children to finish disposing,
+ *   and abandons whatever is left rather than hanging its caller (the engine
+ *   documents what abandonment leaves behind).
  */
 export abstract class WorkflowService extends Service {
   constructor(ctx: Context) {
@@ -199,12 +202,16 @@ export abstract class WorkflowService extends Service {
   abstract start(request: WorkflowStartRequest): WorkflowRun
 
   /**
-   * Emit one `workflow/*` lifecycle event with PER-LISTENER containment:
-   * dispatch each subscriber individually and log (never propagate) a thrown
-   * one, so one bad subscriber can neither fail the engine mid-run, surface as
-   * an unhandled rejection on a detached settle hook, nor starve the listeners
-   * registered after it (cordis `emit` halts on the first throw — same
-   * guarantee as the subagent seam's lifecycle emits).
+   * Emit one `workflow/*` lifecycle event with PER-LISTENER containment and
+   * PER-LISTENER payload snapshots: each subscriber is dispatched individually
+   * with its OWN structural clone of the payload (the payloads are plain JSON
+   * data by the seam contract), so a listener mutating what it received can
+   * corrupt neither the engine's live state nor any other listener's or later
+   * event's view; a thrown listener is logged (never propagated), so one bad
+   * subscriber can neither fail the engine mid-run, surface as an unhandled
+   * rejection on a detached settle hook, nor starve the listeners registered
+   * after it (cordis `emit` halts on the first throw — same guarantee as the
+   * subagent seam's lifecycle emits).
    * @param name - the `workflow/*` event to dispatch.
    * @param args - the event's payload, matching its declared signature.
    */
@@ -213,7 +220,7 @@ export abstract class WorkflowService extends Service {
       try {
         // The declared workflow/* signatures are all void-returning emits; the
         // dispatch callback applies the payload tuple.
-        ;(callback as (...payload: unknown[]) => void)(...args)
+        ;(callback as (...payload: unknown[]) => void)(...structuredClone(args))
       } catch (error: unknown) {
         this.ctx.logger.warn(`workflow: ${name} listener threw: ${String(error)}`)
       }