#9854 feat(api): run a pinned deployment version and expose paused run points in v2

Summary

• Fixes pinned deployment versions being ignored by the executor: executeWorkflowService loaded the pinned version only for its variables while the core ran the active graph. The pin now reaches loadWorkflowState on the sync, stream, and queued paths (this also makes MCP serve run the version it advertised)
• Adds run: { source: 'deployment', version } to POST /api/v2/workflows/{id}/execute to run an earlier deployment version without activating it. It requires write access (operation workflows.execute_version); an unknown version is a 404 and anonymous public-API callers can't pin
• GET /api/v2/workflows/{id}/runs/{runId} now reports the version that ran and paused.points: every pause point with block, kind, status, parallel/loop position, queue position, input fields, and display content
• Pause display content is redacted against the run's resolved secrets at capture time and withheld on the same permission-group terms as the run's outputs; points captured before this change expose no content
• Fixes queued API, scheduled, and webhook runs using the editor's draft variables instead of the deployed version's (versions deployed before variables were snapshotted keep the previous fallback), and queued runs now take blocks and variables from the same version
• Documents running an earlier version and paused run points in the deployment API docs

Deploy note: a background worker on the previous release ignores pinnedDeploymentVersionId and runs the active version, so deploy workers with or before the web tier.

Type of Change

• Bug fix
• New feature

Testing

• Integration against PostgreSQL: execute-workflow-version.integration.ts (pinned sync/async runs execute v1 while v2 is active; red with the executor fix reverted), deployed-run-variables.integration.ts (queued/schedule/webhook variables, legacy fallback), read-workflow-run-pause.integration.ts (display withheld for restricted viewers), pause-persistence.integration.ts (multi-branch points, redaction through the real engine with an encrypted secret, oversized display keeps input fields, legacy points)
• Unit: human-in-the-loop manager, execution status, execution core, engine, v2 runs/execute routes, schedule and webhook execution
• tsc on apps/sim; check:openapi, cli-api, mcp-operations, v2-route-table, api-validation:strict, permission-group-enforcement, actorless-executor-operations, capability-subject, application-graph, boundaries; root scripts and sim-cli suites; biome
• apps/sim/scripts/test-workflow-pinned-execute-e2e.ts covers the HTTP-only paths against a dev stack

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)