Flightcheck: add WD-WF-CAT-001 Workday custom-workflow inventory checklist

[apurvabanka]

Summary

Adds WD-WF-CAT-001 — a MANUAL FlightCheck row that enumerates Workday
scenarios wired up in customer topics that fall outside the 17 OOTB
workflows the kit ships SOAP tests for. The check walks every agent topic
under workspace/agents/*/topics/*.mcs.yml for two wiring patterns,
diffs the discovered scenarios against the tenant-live OOTB catalog
(read from Dataverse msdyn_employeeselfservicetemplateconfigs where
ismanaged=true), and surfaces any unknowns as a bucketed MANUAL row
with a four-item operator checklist plus a gap-discovery loop-back.

A companion WD-WF-CAT-LINK trailer fires from inside _check_workflows
so admins reading a clean 17-row SOAP-test pass don't miss the manual
row below it.

Addresses 6 incidents rooted in this gap pattern (custom workflow
names not in the 41-workflow catalog), notably:

• 760098889 — Multiday Leave application topic
• 783902203 — conversation flow specifics

Parent feature: AB#7392268.
Action owner for MANUAL row triage: Workday admin.

Acceptance criteria

• AC1 — Checklist enumerates: which custom Workday workflows are
  wired up, ISU account used, expected payload shape, test prompt
  (pinned by test_unknown_scenario_emits_manual_with_full_checklist)
• AC2 — Linked from Test-WorkdayWorkflows output when an unknown
  workflow name is referenced in customer topics
  (pinned by test_trailer_emitted_when_unknowns_exist /
  test_trailer_absent_when_clean)
• AC3 — Includes a "found a new pattern? log it here" loop back
  to the gap-discovery process
  (pinned by test_checklist_includes_gap_discovery_loopback)

Failure modes covered in the remediation text

Ticket failure mode	Checklist item that addresses it
Problem 1 — Workflow Contract/Payload Mismatch (adaptive card submit fails because the request payload doesn't match the Workday SOAP/template contract)	Item 2 (Payload shape) — directs operator to open the template config XML and confirm field names, reference types, and required vs. optional elements match the Workday WSDL. Names "the 'Workflow Contract/Payload Mismatch' failure mode" verbatim.
Problem 2 — Intermittent Workday Authentication Failure (expired/revoked OAuth token state on one or more connection references)	Item 4 (Auth health) — cross-links to WD-CONN-* connection token-health output and gives the Power Platform Maker → Connections re-authenticate click-path.

What changed

File	Purpose
solutions/ess-maker-skills/scripts/flightcheck/checks/workday.py	New _check_custom_workflow_inventory (WD-WF-CAT-001) + _append_wd_wf_cat_link_trailer (WD-WF-CAT-LINK) + topic/workflow walkers + Dataverse catalog resolver. Wired into run_workday_checks after the SOAP tests.
solutions/ess-maker-skills/src/reference/ess-docs/flightcheck/validation-matrix.md	Adds WD-WF-CAT-001 + WD-WF-CAT-LINK rows under §5 Workday Deep Validation with status-decision matrix prose.
tests/flightcheck/checks/test_workday_custom_inventory.py	15 tests covering every branch (gates, MANUAL, PASS, WARNING, both patterns, bucketing, caching, all three ACs, all 4 Dataverse-catalog resolver legs).

Design notes

Two detection patterns

• Pattern A — topic calls
  WorkdaySystemGetCommonExecution with a scenarioName: value. Walker
  finds the dialog: ...WorkdaySystemGetCommonExecution line and looks
  backward up to 30 lines for the nearest scenarioName:.
• Pattern B — topic uses kind: InvokeFlowAction with a flowId that
  resolves to a workflow.json whose connectionReferences bind to
  shared_workdaysoap. Conservative qualification — non-Workday flows
  (e.g. ServiceNow-bound) are ignored so the check doesn't emit false
  positives.

Catalog source — live Dataverse, no fallback

The OOTB scenario catalog is resolved per-invocation from the customer's
own tenant by querying msdyn_employeeselfservicetemplateconfigs and
treating every row with ismanaged=true as OOTB. This auto-detects every
scenario the installed Workday extension pack ships — no kit-side
curation, no stale JSON catalog to maintain. Result is cached on
runner._workday_ootb_catalog_cache so the cross-link trailer can
re-read without re-querying.

Status decision matrix (per AGENTS.md principles #1, #2, #3, #11)

Tenant state	Status	Why
Simplified Workday install (1 conn ref, OBO)	SKIPPED	ISU/scenario inventory doesn't apply (gated on runner._workday_package_flavor == "simplified" per principle #11)
workspace/agents/ missing	SKIPPED	Run /setup first
Zero Workday refs in any topic	SKIPPED	No Workday wired into this agent
Workday refs exist but no Dataverse token	SKIPPED	Cannot resolve catalog → can't claim PASS (principle #1)
Dataverse query errored (500, etc.)	WARNING	Surface error verbatim (principle #3)
Every discovered ref is a managed row	PASSED	—
Any unknown / Pattern-B ref	MANUAL	4-item checklist + AC3 loop-back; bucketed to ONE row per principle #7