Flue workflow runs go private by default and flue logs is removed (staged in Unreleased)

What this changes for operators

• Staged in the CHANGELOG ## Unreleased section on main (NOT in the in-window v1.0.0-beta.1/beta.2 tags): workflow runs become private over HTTP unless the workflow separately exports a runs: WorkflowRunsHandler, admission receipts shrink to { runId }, streamUrl/offset are dropped, and the flue logs command is removed in favor of typed SDK access (client.runs.get()/events()/stream()).
• This is direction, not a shipped default: the in-window beta.1 tag still documents flue logs as functional with the old { streamUrl, offset } envelope. Operators should plan migrations off flue logs and the old run envelope, but not assume the new default is live until it tags.