[flows-tinyflows] Authoring/Catalog: full NodeKinds contracts, ApplyGraphOps, ApprovalManifest, ImportGraph (slice 3) #3

Moved from tinyhumansai#147, which is closed in favour of this issue. Part of tinyhumansai/openhuman#8055.

• NodeKinds returns full contracts (fields, ports, examples, notes), not NodeKindInfo. Move NodeKindContract, with_note, render_node_kinds_{line,required} into the contract crate so hosts can overlay notes and render tool descriptions without linking the engine (host flows/node_contracts.rs, OverlayNodeKinds, propose_workflow description).
• Serve ApplyGraphOps (graph_ops::apply_ops).
• Serve ApprovalManifest as already split in tinyflows-catalog::approval_manifest: the module lists candidates, the host classifies each over a callback (its tiers and tool registry), the module assembles.
• Add ImportGraph (n8n mapping, tinyflows_catalog::import::n8n) to Authoring.
• ValidateGraph resolves sub_workflow children through AuthoringHost.ResolveWorkflow, so validate and create agree (host ops/validation.rs:74 vs definitions.rs:61).

Follow migrate-to-submodule (OpenHuman .claude/skills/): upstream PR → patch release → OpenHuman gitlink bump + registry digest re-pin. Design reference: docs/tinyflows-bus-design.md.

Done when: merged in tinyhumansai/tinyflows with wire tests for every new or changed contract type, released (patch), and the contract version bumped where a served shape changed. Gates: cargo fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all-features in tinyhumansai/tinyflows. OpenHuman adoption is a separate leaf of the epic.

Agent brief

• Files to consider (paths in tinyhumansai/tinyflows): crates/tinyflows-bus/src/{lib,catalog}.rs, crates/tinyflows/src/catalog.rs, crates/tinyflows-module/src/
• Research: Host flows/ops/{validation,approval_manifest,builder_gates}.rs, flows/node_contracts.rs.
• Workflow: an implementing-an-epic step; follow migrate-to-submodule (upstream PR → patch release → OpenHuman gitlink bump + digest re-pin).
• Subagent: tdd-implementer.
• Dependencies: none.

Parent: tinyhumansai/openhuman#8055