fix(workflow): safely remap plugins during cross-environment import - #1611

Summary

This fixes the cross-environment workflow import problem described in #1603. A plugin's toolId is local to one deployment, so importing the YAML into another environment used to drop the binding even when an equivalent plugin was already available there.

The importer still prefers the original ID. If that ID is unavailable, it now remaps only when there is exactly one compatible plugin in the current personal or space scope. Ambiguous or incompatible matches stay unbound and are reported to the user instead of being guessed.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring

Related Issue

Closes #1603

Changes

• add a versioned, portable plugin descriptor to exported workflow YAML (name plus a canonical schema fingerprint; no endpoint, credentials, or raw schema)
• preserve direct-ID compatibility, including existing draft plugins
• fall back only to a unique, formal, visible, same-version and schema-compatible plugin in the current personal/space scope
• replace the complete runtime identity together (pluginId, operationId, appId, version and derived inputs), or fail closed without leaving a partial binding
• return an import report while keeping the existing top-level Workflow response shape
• show unresolved plugin nodes after import so they can be selected manually
• validate space membership before importing into a requested space

Testing

• Existing tests pass
• New tests added
• Manual testing completed

Ran locally with Java 21 and Node.js 20:

• full console backend test suite: mvn test
• targeted workflow import suite: 18 tests, 0 failures
• backend CI gates: compile, Spotless, Checkstyle, SpotBugs and PMD
• frontend Prettier and ESLint checks
• frontend production build

The repository's full TypeScript check still reports pre-existing errors across unrelated files; the CI workflow treats that step as non-blocking, and none of the errors point to the files changed here.

Screenshots (if applicable)

Not included. The UI change is an import warning that only appears when plugin remapping cannot be done safely.

Checklist

• Code follows project coding standards
• Self-review completed
• Documentation updated (not needed for this bug fix)
• Breaking changes documented (none)

实现过程中使用了 OpenAI Codex（GPT-5）辅助分析调用链和补充测试。我逐项审阅了代码、权限边界和测试结果，并对这次提交负责。