Reject conflicting workflow timeout units

[vultuk]

Fixes #1849.

Summary:

• Adds a workflow duration parser that accepts exactly one timeout representation and rejects conflicting units such as timeout_seconds plus timeout_minutes before registration.
• Adds pre-dispatch validation so stale invalid timeout mappings cannot move a workflow from pending to running.
• Records sanitized workflow-definition audit decisions and increments a workflow.duration.invalid metric without copying private runtime data.
• Includes current-main suite health fixes: AgentStatus export and metrics RLock timer behavior.

Validation:

• uv run pytest tests/test_workflow.py tests/test_metrics.py tests/test_scheduler.py -q -> 12 passed
• uv run pytest -q -> 25 passed
• uv run flake8 src/orchestrator/workflow.py src/agent/__init__.py src/common/metrics.py tests/test_workflow.py -> passed
• python3 -m py_compile src/orchestrator/workflow.py src/agent/__init__.py src/common/metrics.py tests/test_workflow.py -> passed
• git diff --check -> passed
• Star gate verified: true

BTC payout wallet if accepted: bc1qa5acxqc3wldzxwjhe8a65gjp6n7dxmafm6qs4j