#7088 feat(workflows): expose authenticated run subjects

Summary

• preserve authenticated principals across synchronous, queued, resumed, and nested workflow execution
• expose normalized Sim user, chat email, and provider subjects through optional Start run metadata
• keep actorless callers identity-free and enforce subject-scoped credential access

Type of Change

• New feature

Testing

• 771 tests across 31 changed test files
• bun run lint
• bun run check:audits (33 audits)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)