Migrate workflow-plugin-cicd to strict gRPC proto contracts

[intel352]

Goal

Migrate this plugin to Workflow strict gRPC proto contracts so contract shape issues are caught during code generation, compilation, wfctl validation, or startup checks instead of runtime execution.

Context

Workflow now supports strict plugin contract descriptors and typed proto payloads. See GoCodeAlone/workflow docs/plans/2026-04-26-strict-grpc-plugin-contracts.md and docs/WFCTL.md for wfctl audit plugins --strict-contracts and wfctl plugin validate --strict-contracts behavior.

Current workspace audit result for this repo:

• manifest shape: canonical
• modules: 0/1 strict
• steps: 0/31 strict
• findings: missing module contract descriptor, missing step contract descriptors

Required work

• Inspect this repository's AGENTS.md, CLAUDE.md, README, Makefile, go.mod, plugin manifest, proto/codegen setup, and tests before editing.
• Update the plugin to use strict proto-backed contracts for every advertised module and step.
• Add or update proto messages for typed module config, step config/input/output, and any service method payloads this plugin exposes.
• Add plugin.contracts.json or inline manifest contracts in the format expected by Workflow's current wfctl strict contract audit.
• Replace map-only boundary parsing at plugin entrypoints with Workflow SDK typed adapters where applicable, while preserving internal behavior.
• Keep compatibility code only when explicitly needed and documented; strict descriptors should be the default for advertised types.
• Update docs only where they help future maintainers run validation or understand generated code.

Validation

Run and include results in the PR body:

• go test ./...
• go test -race ./... if it is practical for this repo; otherwise explain why not.
• go vet ./...
• go mod tidy and confirm no unintended diff remains.
• Build the plugin binary using the repo's normal build command.
• With a current wfctl, run wfctl plugin validate --file plugin.json --strict-contracts.
• From a sibling Workflow checkout if available, run GOWORK=off go run ./cmd/wfctl audit plugins --repo-root <workspace-root> --strict-contracts and confirm this repo no longer reports strict-contract findings.

PR expectations

• Open a PR against the default branch.
• Request Copilot code review on the PR.
• Keep iterating until CI is green and meaningful Copilot review comments are addressed.