[joshrotenberg]

A lost-response retry could double a workflow budget again if the first resume immediately hit its new limit. Independent MCP clients also had no way to resolve that budget pause.

Adds operator-only workflow_budget_resume(run_id, pause_id) through the shared operator service. Each pause has a durable reference; its first approval atomically records the human, old/new budget, event and pending dispatch. Repeated approval returns the original receipt without raising a newer pause or recreating cancelled, discarded or removed jobs. A failed initial dispatch can recover while its marker remains pending. Receipt status describes admission, not current execution or completion.

Inbox, Workflows and Console carry the pause shown when the operator clicked. A delayed Console click remains bound to that pause after a refresh. MCP clients discover the same reference through list_attention; the behavior catalog and generated reference document inputs, receipts, authority and refusal semantics.

Validation:

• 259 focused checks pass under seeds 1, 12345 and 777, including authenticated HTTP discovery/resume for both supported protocols.
• Concurrent approvals, immediate re-pause, terminal races, failed decision/dispatch writes, retained retry receipts and unchanged prompt hashes use deterministic fixtures with execution disabled.
• Migration coverage exercises the actual upgrade, repeated migration and rollback on legacy rows. Independent review covered transaction and authority boundaries plus all UI callers.
• All five repository gates and generated-reference check pass: 2,672 full-suite checks passed, 3 excluded; strict lint and Dialyzer clean. CI must pass on the updated head before merge.

Operating note

Adds workflow pause/decision storage and an operator-only MCP capability. Budget-resume controls now require the displayed pause reference and shared human authority. Migration assigns references to existing paused runs without resuming them or inventing historical approval/time. A running installation needs a pull, migration and restart to adopt the change; those operations are not performed on the fleet by this PR.

This is the budget-resume slice of #846; the issue remains open for attachments and the remaining operator-action inventory. General workflow retry/boot policy is unchanged. Recovery tests exercise persisted admission through runner entry points, not a native process crash or proof of subprocess settlement. No native model proof calls.

Refs #846.