refactor(wfe): decompose steps into atomic config-driven primitives

Replace big-bag steps with 10 atomic primitives that each do one
thing and read config from step_config:

- ApplyManifest (replaces 12 identical apply structs)
- WaitForRollout (replaces WaitForCore loop)
- CreatePGRole, CreatePGDatabase (replaces EnsurePGRolesAndDatabases)
- EnsureNamespace, CreateK8sSecret (replaces CreateK8sSecrets)
- SeedKVPath, WriteKVPath, CollectCredentials (replaces SeedAllKVPaths + WriteDirtyKVPaths)
- EnableVaultAuth, WriteVaultAuthConfig, WriteVaultPolicy, WriteVaultRole (replaces ConfigureKubernetesAuth)

Workflow definitions now use parallel branches for independent
operations (infra, KV seeding, PG roles, platform manifests,
K8s secrets, rollout waits).

src/workflows/primitives/mod.rs

@@ -0,0 +1,29 @@
+//! Atomic workflow primitives.
+//!
+//! Each step does exactly one thing, reads its config from `ctx.step.step_config`,
+//! and can be composed with `.config(json!({...}))` in workflow definitions.
+
+mod apply_manifest;
+mod collect_credentials;
+pub mod kv_service_configs;
+mod create_k8s_secret;
+mod create_pg_database;
+mod create_pg_role;
+mod ensure_namespace;
+mod opensearch_ml;
+mod seed_kv_path;
+mod vault_auth;
+mod wait_for_rollout;
+mod write_kv_path;
+
+pub use apply_manifest::ApplyManifest;
+pub use collect_credentials::CollectCredentials;
+pub use create_k8s_secret::CreateK8sSecret;
+pub use create_pg_database::CreatePGDatabase;
+pub use create_pg_role::CreatePGRole;
+pub use ensure_namespace::EnsureNamespace;
+pub use opensearch_ml::{EnsureOpenSearchML, InjectOpenSearchModelId};
+pub use seed_kv_path::SeedKVPath;
+pub use vault_auth::{EnableVaultAuth, WriteVaultAuthConfig, WriteVaultPolicy, WriteVaultRole};
+pub use wait_for_rollout::WaitForRollout;
+pub use write_kv_path::WriteKVPath;