feat: add deterministic governed-job workflow template

[niejingchuan]

Summary

• add a model-free Dify Workflow template for the submit-once, bounded-wait lifecycle
• pin the reviewed BailingHub Marketplace plugin package and keep the route as an explicit placeholder
• document English and Chinese import/configuration steps and clarify public-template boundaries
• add repository checks that reject private URLs, local paths, email addresses, IP literals, and secret-like values in the public template

Validation

• uv run ruff check .
• uv run pytest (14 passed)
• uv run python scripts/check_project.py
• parsed Start, Tool, and End nodes with Dify graphon==0.7.0

Remaining acceptance gate

A real Dify Studio import and harmless end-to-end run remain required before this template is submitted to the Dify Creator Center. No credential, deployment URL, production route, or private workflow export is included.