fix: reject conflicting workflow timeout units

[dzkjdxhbgog]

Fixes #1849

Summary:

• add workflow timeout-unit parsing that accepts a single explicit timeout unit and rejects conflicting units before registration
• add create_workflow_from_definition() so invalid definitions never enter the manager's runnable workflow set
• preserve existing workflow lifecycle state when a bad definition is rejected
• record sanitized audit entries and validation metrics for rejected definitions
• keep current main's Windows test-health fixes for AgentStatus export, optional POSIX resource support, and metrics timer locking

Validation:

• python -m pytest tests\test_workflow_timeout_units.py -q
• python -m pytest tests\test_metrics.py tests\test_agent_registry.py -q
• python -m pytest -q
• python -m compileall -q src tests
• git diff --check

Note: python -m flake8 ... could not run because flake8 is not installed in this runner.