Draft-first workflow
Distribution
Safe by default
Foundation ready
Distribution jobs are idempotent, tenant-scoped, and review-gated. External execution is disabled.