fix: keep qualified bundles consistent through sanitization

[abrichr]

What changed

• Regenerate an existing workflow.py after a qualified workflow is saved.
• Add a round-trip test for the generated representation after certification.
• Preserve typed machine-contract strings during bundle sanitization. This includes evidence hashes, workflow step identifiers, qualification UUIDs, environment observer identifiers, and spatial relation enums.

Why

Qualification updates workflow.json and adds the governed authorization template. The previous save path left workflow.py at its pre-qualification state. The outbound sanitizer then correctly refused the bundle because the human-readable file was not the deterministic rendering of the authoritative workflow.

The sanitizer also sent some opaque protocol values to PHI named-entity recognition. False positives could corrupt hashes, step IDs, UUIDs, observer IDs, and relation enums before the reseal check. The fix preserves only the typed machine shapes. It continues to scrub user-derived labels, descriptions, identity text, and target data.

Impact

Qualified bundles now retain one consistent machine and human representation. The sanitizer can retain load-bearing protocol values while it continues to fail closed on user data.

Verification

• UV_CACHE_DIR=/tmp/uv-cache-openadapt uv run pytest -q tests/test_sanitized_artifact.py tests/test_qualification_project.py (147 passed)
• UV_CACHE_DIR=/tmp/uv-cache-openadapt uv run ruff check openadapt_flow/qualification.py openadapt_flow/sanitized_artifact.py tests/test_qualification_project.py tests/test_sanitized_artifact.py
• git diff --check