[senamakel]

Move workflow copilot behavior behind TinyBus while preserving the existing 20-tool portable belt. The compiled module now serves the owning-library tool metadata and invokes those library Tool implementations with a unique, trusted per-call host callback binding. Model arguments cannot choose that callback. The host keeps origin, ToolCallOptions, and configuration in its callback scope; credentials and identity are absent from wire DTOs.

The new propose_workflow remains validate-and-propose only. run_flow starts a saved flow through the host's detached run port. Prompt rendering, standing prompts, resource listing/reads, trail-off helpers, question detection, and backend-failure wording/classification are exposed by Copilot bus operations. Dry runs call the compiled module's Runs.SandboxRun and require the same scoped destination to serve the preflight-only CapsHost.ToolInvoke interface; its reply is ignored by module mocks. Host callback DTOs and all 23 port operation names, payloads, and results are documented in tinyflows-bus.

Validation:

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test -p tinyflows-bus -p tinyflows-copilot -p tinyflows-module
• cargo test --workspace --all-features
• cargo check -p tinyflows-module
• bash scripts/check-published-crate.sh
• bash scripts/verify-module-artifact.sh (all 16 actual-cdylib tests)
• git diff --check

The fail-closed approval-manifest and strict-gate regressions were run as negative controls against the old fallback behavior and failed for the expected unsafe outcomes, then passed after the fix. Logs are under target/debug-logs/issue9/.

Refs #9
Part of tinyhumansai/openhuman#8055