feat(curation): fetchStartableFlows supplements catalogue listing

The /api/ea2/flow/processes endpoint caps at ~203 items and pr_to_po_def
is not in that window for this tenant despite being status=published.
fetchStartableFlows() does a direct GET per allowlist key and merges
results with the catalogue list (allowlist hits take precedence).

Wired into Hub.loadPublishedFlows + agentTools.list_processes +
agentTools.start_process.

src/lib/agentTools.ts

@@ -1,7 +1,7 @@
 import { api } from "./api";
 import { wizardApi } from "./wizardApi";
 import { chatApi } from "./chatApi";
-import { curatedPublishedFlows } from "./flowCuration";
+import { curatedPublishedFlows, fetchStartableFlows } from "./flowCuration";
 
 export interface ToolResult {
   ok: boolean;
@@ -70,10 +70,17 @@ const TOOLS: ToolDef[] = [
       const processName = subjectMatch ? subjectMatch[1] : phrase;
       const subject = subjectMatch ? subjectMatch[3] : undefined;
 
-      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
-        headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
+      const token = sessionStorage.getItem("fm.mc.token.v1") || "";
+      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=500`, {
+        headers: { Authorization: `Bearer ${token}` },
       }).then((r) => r.json());
-      const items = curatedPublishedFlows((procs?.items || []) as any[]);
+      const fromList = curatedPublishedFlows((procs?.items || []) as any[]);
+      const directHits = await fetchStartableFlows(api.config.baseUrl, token);
+      const items = (() => {
+        const m = new Map<string, any>();
+        for (const it of [...directHits, ...fromList]) m.set(it._key, it);
+        return Array.from(m.values());
+      })();
       const norm = (s: string) => s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
       const target = norm(processName);
       const match = items.find((it) => norm(it.display_name || "").includes(target) || norm(it.name || "").includes(target));
@@ -128,12 +135,17 @@ const TOOLS: ToolDef[] = [
     description: "List published processes for this tenant",
     matcher: /^(list|show|what)\s+(processes|workflows|flows)/i,
     async run() {
-      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
-        headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
+      const token = sessionStorage.getItem("fm.mc.token.v1") || "";
+      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=500`, {
+        headers: { Authorization: `Bearer ${token}` },
       })
         .then((r) => r.json())
         .catch(() => ({ items: [] }));
-      const published = curatedPublishedFlows((procs?.items || []) as any[]).slice(0, 10);
+      const fromList = curatedPublishedFlows((procs?.items || []) as any[]);
+      const directHits = await fetchStartableFlows(api.config.baseUrl, token);
+      const merged = new Map<string, any>();
+      for (const it of [...directHits, ...fromList]) merged.set(it._key, it);
+      const published = Array.from(merged.values()).slice(0, 10);
       if (!published.length) return { ok: true, display: "No published processes yet. Open the Studio to design one." };
       const lines = published.map((it) => `• ${it.display_name}`).join("\n");
       return { ok: true, display: `Here's what's published:\n${lines}` };