feat: KEEP-1053 add kh workflow enable and disable

[suisuss]

Summary

There was no discoverable way to turn a workflow on. Scanning kh workflow --help you see pause (turns off), go-live (publishes a template) and
update (no enable flag). Nothing says enable, so a tutorial ending "now turn it
on" had to send readers to the web UI or a raw PATCH /api/workflows/<id>.

The capability existed as resume - named for the inverse of pause rather
than for the action - so searching for "enable" found nothing.

enable and disable become the primary names.

Backwards compatibility

resume, activate and pause are kept as aliases and stay working
indefinitely. Scripts, tutorials and already-published doc links depend on them.

Tests pin each alias to its command, so a later rename cannot quietly drop one.
The pre-existing pause/resume tests were kept invoking the old names, which
means they now double as alias coverage.

One visible behaviour change

Runtime output follows the new vocabulary:

Workflow abc123 disabled     (was: paused)
Workflow abc123 enabled      (was: resumed)

Worth calling out for anyone matching on those strings. I changed it deliberately
rather than leaving it: the command and its own output would otherwise disagree,
which is exactly the confusion this PR exists to remove.

Help text now cross-references

Each command points at its opposite, so landing on one leads to the other:

Enable a workflow so it runs on its trigger.

Turns on a workflow that is currently disabled. This is the last step after
creating one - a workflow does nothing until it is enabled.

See also: kh workflow disable

A test asserts the cross-reference in both directions, since it is the part most
likely to rot.

This is the first real exercise of #78's pruning

Regenerating deletes kh_workflow_pause.md and kh_workflow_resume.md and adds
kh_workflow_enable.md and kh_workflow_disable.md.

Before #78 the two old pages would have survived as orphans - published, indexed
in _meta.ts, and documenting commands whose primary names no longer existed.
That is precisely the failure #78 was built to prevent, now demonstrated on a
real rename rather than a planted canary.

Test plan

• Aliases resolve: enable/resume/activate -> enable;
  disable/pause -> disable
• Existing pause/resume tests still pass while invoking the old names
• Cross-references asserted in both directions
• go build, go vet, golangci-lint run ./... (0 issues), full
  go test -race ./... - no failures
• Regeneration replaces the pages rather than orphaning them