[witbrock]

Follow-up hardening for JVNAUTOSCI-2592 after PR #295.

This change:

• moves nested workflow authority caching from reusable environments into a fresh top-level execution scope shared with nested children;
• uses per-key single-flight locking so concurrent records share one actor-scoped authority load without serialising unrelated workflow keys;
• preserves failure retry by caching only successful resolutions;
• rejects workflow_control.for_each configurations that combine stop_on_error=true with success_policy=allow_partial before child lookup;
• documents the fail-fast contract and adds regressions for environment reuse, concurrent resolution, and invalid policy combinations.

Validation:

• 233 focused workflow/durable tests passed;
• the concurrent single-flight regression passed five additional repeated runs;
• Ruff passed for all changed Python files;
• git diff --check passed.

The unrelated untracked uv.lock is not included.

[Copilot]

Pull request overview

This PR hardens nested-workflow authority resolution by moving caching and coordination into a dedicated per-execution scope, ensuring correct behaviour under environment reuse and concurrent child lookups while tightening for_each fail-fast policy validation.

Changes:

• Introduces WorkflowExecutionScope and threads it through workflow execution so nested-workflow authority resolution is cached per top-level run (and shared with nested children) instead of living on reusable environments.
• Adds per-key single-flight locking to avoid duplicate concurrent authority loads for the same nested-workflow key while allowing unrelated keys to proceed concurrently.
• Rejects invalid workflow_control.for_each combinations (stop_on_error=true with success_policy=allow_partial) before attempting child definition resolution, with tests and manual documentation updated accordingly.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/backend/test_nested_workflow_actor_authority.py	Adds regressions for execution-scope caching, single-flight concurrency, and environment reuse across top-level runs.
tests/backend/test_control_flow_actions.py	Adds a regression ensuring invalid for_each policy combinations fail before child lookup.
src/backend/workflows/engine.py	Creates/owns a per-run WorkflowExecutionScope and propagates it through action execution paths.
src/backend/workflows/durable/subworkflow_actions.py	Passes execution scope into nested workflow definition resolution and nested executor runs.
src/backend/workflows/durable/nested_workflow_authority.py	Switches caching/locking from environment-local to execution-scope single-flight per cache key.
src/backend/workflows/durable/durable_executor.py	Establishes an execution scope for durable runs and propagates it into state execution.
src/backend/workflows/durable/control_flow_actions.py	Validates for_each policy earlier and propagates execution scope to nested runs/resolution.
src/backend/workflows/action_registry.py	Defines WorkflowExecutionScope and plumbs optional scope through WorkflowActionRequest and ActionRegistry.execute.
docs/engineering/von_workflow_language_manual.md	Documents the strengthened for_each contract for stop_on_error and partial success.