fix(flow): emit, serve-execute, bench and resume stop assuming a browser

[abrichr]

Fixes the silent web-only paths that the parity matrix (#1282) found. Each one now follows the bundle's recorded surface, or refuses with the reason before any action.

What changed

• emit-mcp: a bundle recorded on Windows, macOS, Linux, RDP or Citrix gets a server whose tool takes no URL. Start it with python server.py --config deploy.yaml (or set OPENADAPT_DEPLOYMENT). It builds the app from that file's backend: section and refuses a section that names another surface. Web bundles are unchanged.
• emit-skill: the SKILL.md for such a bundle says openadapt-flow run bundle --config <DEPLOYMENT_FILE>, not --url <APP_URL>.
• serve-execute: refuses a non-web bundle before any effect: "the reference Execute worker drives a browser only, and this bundle was recorded on 'macos'…".
• bench: refuses a non-web bundle instead of replaying it against the web demo.
• console --attend: the attended action service refuses Citrix without backend.rdp_readiness_text, as run and resume already do.
• resume: refuses a backend that isn't the bundle's recorded surface, unless --allow-surface-override is passed. run already worked this way.
• README: one paragraph on the desktop emit-mcp server.

Tests

• tests/test_backend_parity_refusals.py covers each item. For emit-mcp it loads the generated server with a fake FastMCP and checks three cases: no deployment file, the wrong surface, and a Citrix section that builds the backend and passes execution_target_kind.
• tests/test_cli_new_commands.py: a new resume surface-mismatch test.
• Locally: test_backend_parity_refusals.py, test_emit.py and test_cli_new_commands.py give 76 passed. Attended, execute, console, surface-selection and run-gate suites give 318 passed.

The matrix rows for these move from "web only (silent)" to tested in #1282's follow-up, after both merge.

🤖 Generated with Claude Code

Review fixes (second commit)

• The generated desktop server now runs openadapt-flow run bundle --config <file> for each call. Params go in an owner-only file that is deleted after the run. So backend hints, the Citrix readiness refusal, the record check, policy and approvals all apply, and a run refusal comes back as REFUSED (tested end to end against the real CLI).
• Workflow parameters named like locals (kind, section, workflow) reach the run unchanged. The web template now builds params first too.
• resume --allow-surface-override records the override in the resumed report, as run does.
• bundle_surface reads a multi-surface bundle's primary surface.