Story: Entity classification and drift baseline: ores.workflow

Bring ores.workflow to the state the compass-codegen-fix-drift skill defines: every codegen-eligible entity bound to a profile or recorded as a genuine no-match, zero-diff regeneration verified, and any real gap the check surfaces fixed rather than skipped. Once trusted, workflow-cpp joins the known-drift-free registry that the drift gate checks.

• Every ores.workflow entity is bound to a matching Variability Profile, or recorded as a genuine no-match with a documented reason.
• Every rebound entity is regenerated and diffed against its pre-rebind checked-in output; zero diff is the pass condition, and any non-zero diff is fixed, not worked around.
• Full local build clean, schema drift current per compass db status, full ctest suite green after regeneration.
• workflow-cpp joins the KNOWN_DRIFT_FREE registry in check_component_drift.py (skill step 8), and the compass-pr-raise skill's local codegen-drift check runs --all over the registry, so future PRs touching ores.workflow fail on any regeneration drift.
• The superseded ad hoc task 'Apply safe drift to workflow-cpp' is marked ABANDONED, pointing here.
• The known stateful-to-stateless repository migration (already noted as required via regeneration) is completed as part of reaching zero drift.
• Done shape (2026-09-07 program decision): the bind task closes at the drift gate. The story closes only after the post-merge live system test: recreate the database, provision a tenant, and exercise this component's flows. Defects the test surfaces get follow-up tasks on this story. The compute/iam binds set this shape: their live system test caught a service-grant defect ctest cannot see.

Abandoned at sprint 25 close. Sprint 26 replaces the codegen approaches tried so far with one method: for each module, sync codegen and clear its drift. Sprint 26 opens new, clean stories for each module. This story is not carried forward.