Function resolve_workflow_agent 

pub fn resolve_workflow_agent(
    role: Option<&str>,
    profile: Option<&str>,
    fleet: &FleetRoleMap,
    require_known_role: bool,
) -> Result<ResolvedWorkflowAgent, FleetRoleResolveError>

Resolve step identity from optional role + optional explicit profile against a fleet role map.

When require_known_role is true and role is set without an explicit profile, the role must exist in fleet (unknown roles fail clearly). When false, an unknown role falls through to role_as_profile (useful when the dispatcher will validate membership later against a full roster).