Couple trigger enabled state to workflow lifecycle

[elias-ba]

Closes a gap left by the lifecycle work: trigger enabled state could still be set directly, independently of a workflow's draft/live state. That allowed a draft workflow to run a live trigger against production, which contradicts the lifecycle contract that draft means "not processing data". Trigger enabled now follows the lifecycle, with go live and switch to draft as the only controls that change it.

What changed

• The dashboard on/off toggle routes through go live / switch to draft, so a workflow's state and its triggers always move together. The activation usage limit that the old toggle enforced is preserved.
• The standalone enable controls in the collaborative editor (the header switch and the trigger inspector toggle) are removed. The draft/live badge plus go live / switch to draft now carry the full meaning. The dead client-side enable plumbing is removed as well, so the client can no longer desync triggers from state at all.
• On import, a workflow's state is inferred from its triggers when not explicitly provided. This keeps imported workflows coherent and fixes a real round-trip bug: a live workflow exported and re-imported (CLI deploy, GitHub sync, YAML) previously came back as a draft with its triggers disabled.

Scope

The legacy LiveView editor toggle is intentionally left untouched since that editor is being sunsetted.

Three pieces that cannot be finished from this repo are tracked as follow-ups on the epic: carrying state in the project.yaml wire format (#4897), making the live read-only lock write-authoritative on the sync channel (#4898), and the AI prompt cleanup (#4899).

Additional notes for the reviewer

[github-actions]

Security Review ✅

• S0 (project scoping): New go_live/switch_to_draft channel handlers operate on the session-bound workflow that WorkflowChannel.load_workflow/5 already resolves through WorkflowResolver with project: project (lib/lightning_web/channels/workflow_channel.ex:1252), so the lifecycle transition cannot reach a foreign-project workflow; provisioner's new :state cast inherits its existing project-auth path.
• S1 (authorization): transition_lifecycle_state/2 gates both go_live and switch_to_draft on authorize_edit_workflow/1 → Permissions.can(:project_users, :edit_workflow, ...) (lib/lightning_web/channels/workflow_channel.ex:1113), and test/lightning_web/channels/workflow_channel_test.exs:55 verifies a :viewer is rejected.
• S2 (audit trail): Workflows.go_live/2 and switch_to_draft/2 both flip trigger enabled alongside state and route through save_workflow → build_save_multi → maybe_audit_workflow_state_changes (lib/lightning/workflows.ex:559), which inserts the existing "enabled"/"disabled" audit event in the same transaction.