docs: retire the workflow slot from four more hand-written pages (#4451)

The docs-drift check on PR #4473 earned its keep: my symbol-shaped grep
(`IWorkflowService`, `WorkflowProtocol`, `api/v1/workflow`) found three pages
and missed four PROSE mentions that describe the same retired slot in words.

- `api/plugin-endpoints.mdx` documented three `/workflow/*` routes under a
  "not yet mounted … return 404 today" caveat. The caveat was already the
  tell: routes that 404 for the whole life of the declaration are not "not
  yet", and the slot behind them is gone now. The section becomes a redirect
  naming the three live mechanisms.
- `kernel/services-checklist.mdx` carried it in three more places — the
  legend's 36-method count (now 33), the `null`-provider explanation, and a
  full "6. workflow Service" section still describing the three methods as
  pending rather than removed.

The remaining `workflow` hits in `content/docs` are the ordinary English word
(approval workflow, build workflow, GitHub Actions workflows) and stay.

Author: claude

content/docs/api/plugin-endpoints.mdx

@@ -26,19 +26,21 @@ Authenticate with email and password (better-auth's email sign-in route, mounted
 
 The following endpoints become available when the corresponding plugin is installed and registered with the kernel. Use the discovery `services` map to check availability.
 
-### Workflow (`/workflow`) — Plugin Required
+### Workflow (`/workflow`) — removed in v17
 
 <Callout type="warn">
-Not yet mounted. These routes are declared in the API protocol but the core dispatcher registers no `/workflow` handler and no bundled plugin provides a `workflow` service (only an in-memory dev stub), so they return **404** today. `discovery.services.workflow` reports `unavailable` in a standard install.
+There is no workflow endpoint, and there is no `workflow` service slot. The
+three routes documented here were declared in the API protocol and served by
+nothing — no dispatcher handler, no plugin — so they 404'd for the whole life
+of the declaration. The slot, the `WorkflowProtocol` methods behind it and the
+discovery fields that reported it were all retired in v17 ([#4451](https://github.com/objectstack-ai/objectstack/issues/4451)).
+Use the live mechanisms instead: an object validation rule of type
+`state_machine` for lifecycle transitions, an `approval` flow node for human
+approval pauses (ADR-0019), and lifecycle hooks / `record_change` flows for
+record-triggered automation.
 </Callout>
 
-| Method | Endpoint | Description |
-|:-------|:---------|:------------|
-| GET | `/workflow/:object/config` | Get workflow configuration |
-| GET | `/workflow/:object/:recordId/state` | Get record's workflow state |
-| POST | `/workflow/:object/:recordId/transition` | Execute state transition |
-
-Approve/reject are **not** workflow routes (ADR-0019): approval is a flow node, and decisions are recorded on the approvals runtime via `POST /approvals/requests/:id/approve` and `POST /approvals/requests/:id/reject`.
+Approve/reject were never workflow routes (ADR-0019): approval is a flow node, and decisions are recorded on the approvals runtime via `POST /approvals/requests/:id/approve` and `POST /approvals/requests/:id/reject`.
 
 ### Automation (`/automation`) — Plugin Required
 

content/docs/kernel/services-checklist.mdx

@@ -24,12 +24,14 @@ The ObjectStack protocol defines **16 kernel services** registered via the `Core
 - ✅ Implemented — the 17 kernel-provided protocol methods (`DataProtocol` 9 + `MetadataProtocol` 8)
 - ⚠️ Framework — the slot is filled by the kernel's in-memory fallback: real reads and
   writes, no persistence (self-declares `degraded`, ADR-0076 D12)
-- ❌ Plugin Required — the remaining 36 methods declared across the other per-domain
+- ❌ Plugin Required — the remaining 33 methods declared across the other per-domain
   contracts (`analytics` 2, `automation` 1, `packages` 6, `views` 5, `permissions` 3,
-  `workflow` 3, `realtime` 6, `notification` 7, `i18n` 3). *Declared* is not *routed*:
+  `realtime` 6, `notification` 7, `i18n` 3). *Declared* is not *routed*:
   `packages` is answered kernel-side by the `/packages` dispatcher domain over the
-  ObjectQL registry, `i18n` has a kernel in-memory fallback, and `views` / `permissions` /
-  `workflow` have no implementation anywhere — the rest wait on whatever fills the slot
+  ObjectQL registry, `i18n` has a kernel in-memory fallback, and `views` /
+  `permissions` have no implementation anywhere — the rest wait on whatever fills
+  the slot. (`workflow`'s 3 methods were the fourth such group; the whole slot
+  retired in v17, [#4451](https://github.com/objectstack-ai/objectstack/issues/4451).)
 </Callout>
 
 ---
@@ -90,10 +92,12 @@ installable optional package, so they need no remedy (`NO_REMEDY_SLOTS` in the
 guard script). And `null` there does **not** always mean "nothing ships" — it
 means "no name belongs in an `Install X` sentence", which covers two cases:
 
-- **Nothing provides the slot at all** — `search`, `workflow` (and the retired
-  `graphql`). Discovery says exactly that rather than naming a plausible
-  package: `No implementation ships for the '<slot>' slot — register a service
-  under it to enable`.
+- **Nothing provides the slot at all** — `search`. Discovery says exactly that
+  rather than naming a plausible package: `No implementation ships for the
+  '<slot>' slot — register a service under it to enable`. (`workflow` and the
+  never-real `graphql` sat here too until both were retired outright in v17,
+  [#4451](https://github.com/objectstack-ai/objectstack/issues/4451) — a slot
+  nothing fills and nothing consumes is better removed than explained.)
 - **A provider exists but cannot be installed** — `ai`. `@objectstack/service-ai`
   registers the slot in `objectstack-ai/cloud` and is `private: true`.
 
@@ -333,13 +337,18 @@ the domain answers **501** with that remedy spelled out, not a generic "install
 plugin".
 </Callout>
 
-### 6. workflow Service — 3 methods ❌ Nothing ships
-`getWorkflowConfig`, `getWorkflowState`, `workflowTransition`  
-State machine transitions. No package registers the `workflow` slot
-(`CORE_SERVICE_PROVIDER.workflow` is `null`). Approve/reject are not workflow
-methods — per ADR-0019 they moved to the request-id-based approvals API under
-`/api/v1/approvals` (`POST /requests/:id/{approve,reject,recall}`, served by
-`@objectstack/plugin-approvals`).
+### 6. workflow Service — retired in v17
+The slot, its `IWorkflowService` contract and the three `WorkflowProtocol`
+methods (`getWorkflowConfig`, `getWorkflowState`, `workflowTransition`) were
+removed in [#4451](https://github.com/objectstack-ai/objectstack/issues/4451):
+nothing ever registered or resolved the slot (ADR-0115 Evidence 5), no method
+ever had an implementation, and no host ever mounted `/api/v1/workflow`. The
+three capabilities it named are live elsewhere — state-machine transitions are
+an object validation rule of type `state_machine`, approvals are `approval`
+flow nodes on the approvals runtime (ADR-0019 — decisions via
+`POST /api/v1/approvals/requests/:id/{approve,reject,recall}`, served by
+`@objectstack/plugin-approvals`), and record-triggered automation is lifecycle
+hooks + `record_change` flows.
 
 ### 7. automation Service — 1 method ✅ `@objectstack/service-automation`
 `triggerAutomation`