feat: expose workflow state events and persist signal transitions

internal/storage/mysql/migrations/000025_workflow_event_timeline.up.sql

@@ -0,0 +1,15 @@
+-- 从已有不可变事件派生流程检索范围，不改写历史原文或伪造过去的状态转换。
+ALTER TABLE orbit_events
+ ADD COLUMN workflow_id BINARY(16) GENERATED ALWAYS AS (
+  CASE
+   WHEN aggregate_kind='workflow' THEN aggregate_id
+   WHEN aggregate_kind IN ('workflow_step','workflow_signal')
+    AND JSON_TYPE(JSON_EXTRACT(payload,'$.workflow_id'))='STRING'
+    AND OCTET_LENGTH(JSON_UNQUOTE(JSON_EXTRACT(payload,'$.workflow_id')))=32
+    -- 严格DDL模式下UNHEX非法值会中止迁移，先确认32个字符全部是十六进制。
+    AND OCTET_LENGTH(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(LOWER(JSON_UNQUOTE(JSON_EXTRACT(payload,'$.workflow_id'))),'0',''),'1',''),'2',''),'3',''),'4',''),'5',''),'6',''),'7',''),'8',''),'9',''),'a',''),'b',''),'c',''),'d',''),'e',''),'f',''))=0
+   THEN UNHEX(JSON_UNQUOTE(JSON_EXTRACT(payload,'$.workflow_id')))
+   ELSE NULL
+  END
+ ) STORED COMMENT '从不可变事件派生的流程查询标识；无范围或非法历史值为空，读取仍核对父资源，不能作为授权依据',
+ ADD KEY ix_event_workflow_history(namespace_id,workflow_id,occurred_at,id);