P1-20: normalizeWorkflowSteps used ad-hoc typeof checks that silently accepted malformed entries (e.g. number where string was expected). Replace with workflowStepsInputSchema zod validation; semantics for defaults/action whitelist are preserved.