feat(curation): fetchStartableFlows supplements catalogue listing

The /api/ea2/flow/processes endpoint caps at ~203 items and pr_to_po_def
is not in that window for this tenant despite being status=published.
fetchStartableFlows() does a direct GET per allowlist key and merges
results with the catalogue list (allowlist hits take precedence).

Wired into Hub.loadPublishedFlows + agentTools.list_processes +
agentTools.start_process.

src/lib/flowCuration.ts

@@ -36,7 +36,7 @@ const NON_BUSINESS_SOURCE_CONTEXTS = new Set([
   "EA2_DRAFT_PROCESS:process_creation",
 ]);
 
-const STARTABLE_FLOW_KEYS = new Set<string>([
+export const STARTABLE_FLOW_KEYS = new Set<string>([
   "pr_to_po_def",
 ]);
 
@@ -60,6 +60,21 @@ export function curatedPublishedFlows<T extends RawFlow>(items: T[]): T[] {
   );
 }
 
+export async function fetchStartableFlows(baseUrl: string, token: string): Promise<RawFlow[]> {
+  const results = await Promise.all(
+    Array.from(STARTABLE_FLOW_KEYS).map(async (key) => {
+      try {
+        const r = await fetch(`${baseUrl}/api/ea2/flow/${key}`, { headers: { Authorization: `Bearer ${token}` } });
+        if (!r.ok) return null;
+        const doc = await r.json();
+        if (doc.kind !== "definition" || doc.status !== "published" || !doc.display_name) return null;
+        return doc as RawFlow;
+      } catch { return null; }
+    })
+  );
+  return results.filter((d): d is RawFlow => !!d);
+}
+
 export function friendlyShortId(id: string | undefined | null): string {
   if (!id) return "";
   const trimmed = id.replace(HEX_SUFFIX, "");