feat(adapters): add structured workflow profiles

[alectimison-maker]

Why

Site adapters currently expose their operating knowledge only as prompt-facing notes. Code can match a site, but it cannot enumerate which regions and jobs an adapter covers, distinguish workflow states, identify confirmation boundaries, or require evidence for a successful terminal state.

What changed

• Added the versioned webbrain-adapter-workflow/1 profile and a browser-free validator shared by the mirrored Chrome and Firefox trees.
• Defined stable workflow states for access gates, search, selection, review, commit, payment, fulfillment, and after-sales handling.
• Required semantic evidence for every declared state, explicit confirmation for commit/payment states, and at least one evidence-backed terminal state for every job through terminalFor.
• Added listAdapterWorkflowProfiles() so migrated profiles form an enumerable matrix while the existing listAdapters() contract stays unchanged.
• Migrated the existing China Railway 12306 adapter as the first full profile, covering its access gate, search, selection, review, submission, payment, fulfillment, and after-sales states.
• Added positive, negative, lookup, enumeration, and Chrome/Firefox parity tests.

Compatibility

The metadata is optional. Existing adapters, URL matching, prompt notes, site-adapter enablement, and runtime agent behavior are unchanged. This PR does not infer the active state or alter confirmation behavior; it establishes the validated data contract for those follow-ups.

The helper is byte-identical between Chrome and Firefox, while the 12306 profile is behaviorally compared through the public APIs.

Tests

• node test/run.js — 1414 passed; 1 inherited repository failure remains because package.json is 26.0.4 while the newest CHANGELOG entry is 26.0.0.
• npm run test:security — 60/60 passed.
• npm run test:fixtures — 125/125 passed.
• npm run test:ci — passed (CI scenarios and cloud capture).
• npm run test:webmcp — passed against Chrome 150.

npm run test:anonymous was not run because it requires configured provider credentials and an interactive browser environment.

Risks and follow-ups

V1 intentionally uses semantic evidence rather than selectors so profiles do not introduce a second brittle selector layer. Its strict field validation makes typos fail loudly when the matrix is enumerated.

Follow-up PRs can migrate adapters by region/job and add runtime state inference or prompt enrichment independently. Those behavior changes are deliberately outside this PR.

[vercel]

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.