feat: publish immutable workflow definitions with typed SDK

internal/storage/mysql/bootstrap.go

@@ -14,6 +14,7 @@ import (
 
 // BootstrapInput 仅供持有数据库管理权限的初始化命令使用，不暴露为公共 HTTP。
 type BootstrapInput struct {
+	WorkflowAccess        bool    // WorkflowAccess 显式授予流程定义读取和发布权限，不含实例执行权限。
 	RecoveryAccess        bool    // RecoveryAccess 显式授予任务核查、人工重试及操作审计读取权限。
 	EventAccess           bool    // EventAccess 显式增加结果订阅查询、管理和消费权限。
 	Application           string  // Application 新应用名称，与 ExistingApplicationID 二选一。
@@ -76,6 +77,9 @@ func Bootstrap(ctx context.Context, db *sql.DB, in BootstrapInput, deliver func(
 	if in.WorkerAccess {
 		permissions.Actions = append(permissions.Actions, "workers:connect", "workers:consume")
 	}
+	if in.WorkflowAccess {
+		permissions.Actions = append(permissions.Actions, "workflows:definitions:read", "workflows:definitions:publish")
+	}
 	if in.ScheduleAccess {
 		permissions.Actions = append(permissions.Actions, "schedules:read", "schedules:manage")
 	}