fix(whaleflow): reject unknown workflow references

[Hmbown]

Summary

• reject unknown depends_on_results, reducer inputs, and teacher-review candidates in typed WhaleFlow IR before mock execution or replay
• run the same reference validation at the Starlark compile gate so generated workflows fail closed earlier
• keep dynamically expanded nodes on shape validation only, since Expand.source can describe an external/generated source label in the current mock executor

Stewardship

Refs #2670, #2673, #2726, and #2667. This is a narrow maintainer hardening slice inspired by the WhaleFlow direction in #2482/#2486 without merging the broad draft runtime/worktree surfaces. Thanks @AdityaVG13 for the WhaleFlow draft and cost-tracking direction.

Verification

• cargo test -p codewhale-whaleflow --locked
• cargo fmt --all
• ./scripts/release/check-versions.sh
• ./scripts/release/check-ohos-deps.sh
• cargo clippy -p codewhale-whaleflow --all-targets --locked -- -D warnings
• cargo fmt --all -- --check
• git diff --check
• cargo check --workspace --all-features --locked

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[greptile-apps]

Hmbown has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.