Workflows: export to YAML and 'newer built-in available' flow (git promotion path) #86

Follow-up to #80. Depends on slice 3 (versioned store).

Context

Most prompt iteration happens in EAIStack's versioned store and never touches git. Occasionally a proven workflow should become a built-in default for every deployment and fork, which means it has to get back into the repo and through normal code review. And when a new image ships an updated built-in, an admin who has customized that workflow must not have their change silently overwritten.

This issue covers the provider-neutral part of the git story: no git server, no credentials, no network calls. Integrating with a live git repo is a separate issue (see "Relates to").

Scope

1. Export to YAML: download any version as a YAML file that is byte-for-byte loadable as a built-in, plus a small metadata header (source version ID, author, change note, eval run ID if any) so the PR reviewer can trace it back to its audit record.
2. "Newer built-in available": on startup, if a built-in file's content hash differs from the built-in version last seen, record it as a new builtin version (never auto-published if an admin copy is active). The admin UI shows the diff between the admin's active version and the new built-in, with explicit adopt / keep-mine actions, both audit-logged.
3. Round-trip test: export → load as built-in → identical compiled graph.

User-visible signal

An "Export YAML" action on each version, and an "update available" badge with a diff when a newer built-in ships.

RBAC

Admin feature (require_admin).

Definition of Done

• Export, update-available detection, adopt/keep-mine: TDD.
• Audit events for adopt/keep-mine; docs/AUDIT_EVENTS.md updated.
• Workflow guide documents the promote-to-git process (export → PR → review → CI structural tests → new image).
• Standard merge gate from AGENTS.md's Definition of Done applies in full.