docs: add service README.md files + update AGENTS.md decisions

- Create README.md for 25+ service modules with container info, API surface, storage
- Document attestor-tileproxy separation rationale (air-gap network isolation)
- Document opsmemory-advisoryai separation rationale (resource isolation, blast radius)
- Update Timeline AGENTS.md with merged indexer info

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Workflow/README.md

@@ -0,0 +1,19 @@
+# Workflow
+
+**Container(s):** stellaops-workflow
+**Slot:** (compose inline)  |  **Port:** 8080  |  **Consumer Group:** workflow
+**Resource Tier:** medium
+
+## Purpose
+The Workflow Engine provides a general-purpose workflow runtime for orchestrating multi-step release and operational processes. It supports workflow definition deployment, runtime execution, signal-driven task transitions, dead-letter handling, and authorization-gated task progression. It is the backbone for release promotion workflows.
+
+## API Surface
+- `workflow` (via Router) — workflow definition CRUD, instance lifecycle (start/signal/cancel), task queries, dead-letter management, projection queries (`/api/workflow` prefix)
+
+## Storage
+PostgreSQL schema `workflow` (via `ConnectionStrings:WorkflowPostgres`, `WorkflowBackend:Postgres`)
+
+## Background Workers
+- Signal pump hosted service — processes workflow signals from the event bus
+- Retention hosted service — cleans up completed workflow instances
+- `WorkflowDefinitionBootstrap` — deploys built-in workflow definitions on startup