feat(orchestration): pipeline combinator (Workflow Phase 3)

[ZhiXiao-Lin]

Phase 3 of the Workflow integration (builds on #51, #52). Adds execute_pipeline — the scheduling shape parallel() can't express.

What

• execute_pipeline: each item flows through a chain of stages independently, with no barrier between stages — item A can be in stage 3 while item B is still in stage 1 (wall-clock = slowest single chain, not sum-of-slowest-per-stage).
• PipelineStage<I> = Fn(Option<&StepOutcome>, &I) -> Option<AgentStepSpec>: pure spec-builders that can branch on the prior stage's outcome (e.g. "verify the finding the review stage produced"). The executor runs them.
• Chains run concurrently bounded by the executor's concurrency_hint; a chain stops early on a None stage or a failed step; a panicking stage isolates to its own chain (→ None). Reuses run_ordered_parallel_with_limit; built entirely on the Phase-1 AgentExecutor seam.

Deferred (Rule 6 — no consumer yet): phase-grouping events (would churn the persisted AgentEvent schema + SDK mapping for no current consumer) and a budget-aware loop_until. Both land when the SDK/UI (Phase 5) needs them.

Verification

• 4 mock-based pipeline tests: chaining + prior-output visibility, stop-on-failure/None, no-barrier concurrency bound, panic isolation.
• Real-LLM #[ignore] two-stage chain (stage 2's prompt derived from stage 1's live output) passing against .a3s/config.acl.
• cargo fmt --all --check + cargo clippy --lib --bins -D warnings clean.