controlapi: refactor workflows to typed ensure-steps

[Troy Chiu (troychiu)]

Fixes #554

Each workflow becomes a plain method orchestrating typed, idempotent ensureX steps, e.g.:

func (w *ActorWorkflow) ResumeActor(ctx, ref, boot) (*Actor, bool, error) {
    // acquire actor lock, metrics defer — unchanged
    actor, tmpl, snapSrc, err := w.loadActorForResume(ctx, ref, boot)
    if actor.Status == RUNNING { return actor, false, nil }        // explicit no-op
    actor, err         = w.ensureVolumesCreated(ctx, actor, tmpl)
    actor, worker, err = w.ensureWorkerAssigned(ctx, actor, tmpl)
    err                = w.ensureVolumesAttached(ctx, actor, worker, tmpl)
    tele, err          = w.ensureAteletRestored(ctx, actor, worker, tmpl, snapSrc)
    actor, err         = w.finalizeRunning(ctx, ref)
    return actor, true, nil
}

Each ensureX

• early-returns if its postcondition already holds, which is derived from persisted state only, replacing IsComplete
• validates the state machine edge internally, replacing CheckPrerequisite
• takes explicit typed inputs and returns what it produced.
• persists what it changed before returning, returning the stored copy so the optimistic lock version threads forward. No shared *ResumeState.

There is one behavioral change: worker ownership/eligibility validation for a re-entered resume now runs before volumes are attached (it used to run in CallAteletRestoreStep's prerequisite, after attach), so a resume that is about to crash on a reassigned/ineligible worker no longer attaches volumes to it first.

• Tests pass
• Appropriate changes to documentation are included in the PR