feat: add scoped workflow instance queries and SDK pagination

internal/storage/mysql/workflow_query_test.go

@@ -0,0 +1,27 @@
+package mysql
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	core "git.yuntuo.hk/k2safe/orbit/model"
+	"git.yuntuo.hk/k2safe/orbit/weave/instance"
+)
+
+func TestWorkflowQueryCursorRejectsAmbiguousJSON(t *testing.T) {
+	ns := core.ID("11111111111111111111111111111111")
+	at := time.Date(2026, 9, 18, 0, 0, 0, 0, time.UTC)
+	raw, _ := json.Marshal(workflowCursor{1, ns, at, ns, "digest"})
+	encode := func(s string) string { return base64.RawURLEncoding.EncodeToString([]byte(s)) }
+	if _, err := decodeWorkflowCursor(encode(string(raw)), ns, instance.ListInput{}, "digest"); err != nil {
+		t.Fatal(err)
+	}
+	for _, bad := range []string{`null`, `[]`, strings.Replace(string(raw), `"v":1`, `"v":1,"v":1`, 1), strings.Replace(string(raw), `"v":1`, `"V":1`, 1), strings.Replace(string(raw), `"v":1`, `"v":null`, 1), strings.Replace(string(raw), `"v":1`, `"v":2`, 1), strings.Replace(string(raw), `"f":"digest"`, `"f":"other"`, 1), strings.Replace(string(raw), `"v":1`, `"v":1,"x":0`, 1)} {
+		if _, err := decodeWorkflowCursor(encode(bad), ns, instance.ListInput{}, "digest"); err == nil {
+			t.Fatal("accepted ambiguous cursor", bad)
+		}
+	}
+}