feat(wfe-server): full feature set, debian base, name resolution in gRPC

Proto changes:

* Add `name` to `WorkflowInstance`, `WorkflowSearchResult`,
  `RegisteredDefinition`, and `DefinitionSummary` messages.
* Add optional `name` override to `StartWorkflowRequest` and echo the
  assigned name back in `StartWorkflowResponse`.
* Document that `GetWorkflowRequest.workflow_id` accepts UUID or
  human name.

gRPC handler changes:

* `start_workflow` honors the optional name override and reads the
  instance back to return the assigned name to clients.
* `get_workflow` flows through `WorkflowHost::get_workflow`, which
  already falls back from UUID to name lookup.
* `stream_logs`, `watch_lifecycle`, and `search_logs` resolve
  name-or-UUID up front so the LogStore/lifecycle bus (keyed by
  UUID) subscribe to the right instance.
* `register_workflow` propagates the definition's display name into
  `RegisteredDefinition.name`.

Crate build changes:

* Enable the full executor feature set on wfe-yaml —
  `rustlang,buildkit,containerd,kubernetes,deno` — so the shipped
  binary recognizes every step type users can write.
* Dockerfile switched from `rust:alpine` to `rust:1-bookworm` +
  `debian:bookworm-slim` runtime. `deno_core` bundles a v8 binary
  that only ships glibc; alpine/musl can't link it without building
  v8 from source.

wfe-server-protos/proto/wfe/v1/wfe.proto

@@ -45,6 +45,9 @@ message RegisteredDefinition {
   string definition_id = 1;
   uint32 version = 2;
   uint32 step_count = 3;
+  // Human-friendly display name declared in the YAML (e.g. "Continuous
+  // Integration"). Empty when the definition did not set one.
+  string name = 4;
 }
 
 message ListDefinitionsRequest {}
@@ -58,6 +61,10 @@ message DefinitionSummary {
   uint32 version = 2;
   string description = 3;
   uint32 step_count = 4;
+  // Human-friendly display name declared in the YAML (e.g. "Continuous
+  // Integration"). Empty when the definition did not set one; clients should
+  // fall back to `id` for presentation.
+  string name = 5;
 }
 
 // ─── Instances ───────────────────────────────────────────────────────
@@ -66,13 +73,23 @@ message StartWorkflowRequest {
   string definition_id = 1;
   uint32 version = 2;
   google.protobuf.Struct data = 3;
+  // Optional caller-supplied name for this instance. Must be unique across
+  // all workflow instances. When unset the server auto-assigns
+  // `{definition_id}-{N}` using a per-definition monotonic counter.
+  string name = 4;
 }
 
 message StartWorkflowResponse {
   string workflow_id = 1;
+  // Human-friendly name that was assigned to the new instance (either the
+  // caller override or the auto-generated `{definition_id}-{N}`).
+  string name = 2;
 }
 
 message GetWorkflowRequest {
+  // Accepts either the UUID `workflow_id` or the human-friendly instance
+  // name (e.g. "ci-42"). The server tries UUID first, then falls back to
+  // name-based lookup.
   string workflow_id = 1;
 }
 
@@ -201,6 +218,10 @@ message WorkflowInstance {
   google.protobuf.Timestamp create_time = 8;
   google.protobuf.Timestamp complete_time = 9;
   repeated ExecutionPointer execution_pointers = 10;
+  // Human-friendly unique name, auto-assigned as `{definition_id}-{N}` at
+  // start time, or the caller-supplied override from StartWorkflowRequest.
+  // Interchangeable with `id` in Get/Cancel/Suspend/Resume/Watch/Logs RPCs.
+  string name = 11;
 }
 
 message ExecutionPointer {
@@ -222,6 +243,8 @@ message WorkflowSearchResult {
   string reference = 5;
   string description = 6;
   google.protobuf.Timestamp create_time = 7;
+  // Human-friendly instance name (e.g. "ci-42").
+  string name = 8;
 }
 
 enum WorkflowStatus {