fix(curation): explicit STARTABLE_FLOW_KEYS allowlist

Previous attempt blacklisted unstartable backfill source_contexts but
swept all real published flows out too. Inverted to a positive
allowlist: only flows whose _key is in STARTABLE_FLOW_KEYS reach the
Hubs / Assistant.

Today the canonical pr_to_po_def is the only runtime-startable flow in
the tenant. New entries are added by hand once we've verified a flow
actually starts via /api/runtime/transactions. Cleaner than chasing
source_context strings.

src/lib/flowCuration.ts

@@ -40,11 +40,10 @@ const NON_BUSINESS_SOURCE_CONTEXTS = new Set([
   "CANVAS_SEED_STEP",
   "EA2_WIZARD_STEP",
   "EA2_DRAFT_PROCESS:process_creation",
-  "D2 live backfill 2026-04-25; derived from seed fields, existing description/content, and graph name.",
-  "EA2 runtime reference seed",
-  "atlas-f1-fresh-proof",
-  "EA2 seed payload via POST /api/process",
-  "fm-process-mining-conformance-reseed",
+]);
+
+const STARTABLE_FLOW_KEYS = new Set<string>([
+  "pr_to_po_def",
 ]);
 
 const HEX32 = /[a-f0-9]{32}/gi;
@@ -58,7 +57,12 @@ export function isDevArtefact(f: RawFlow): boolean {
 
 export function curatedPublishedFlows<T extends RawFlow>(items: T[]): T[] {
   return items.filter(
-    (it) => it.status === "published" && it.kind === "definition" && !!it.display_name && !isDevArtefact(it)
+    (it) =>
+      it.status === "published" &&
+      it.kind === "definition" &&
+      !!it.display_name &&
+      !isDevArtefact(it) &&
+      STARTABLE_FLOW_KEYS.has(it._key)
   );
 }