Build the steps + connectors and .commit() the workflow onto the runtime.
INVARIANT the type system cannot enforce: a gate step's suspend payload
connectors MUST be a server-authored static literal (a module-level
const, not a value derived from the run's inputData). The approval bridge
copies it verbatim into the approval record, and an APPROVED record's
connectors ARE the minted grant — so deriving the list from run input would
let client input choose its own capability, re-opening the hole that
TCB_ONLY_CREATE_FIELDS closes at the HTTP boundary.
A workflow packaged for host-agnostic registration.