Send changelog workflow key to AI (#273)

ddiff --git a/server/changelog/tagger.js b/server/changelog/tagger.js
iindex 992e2db..84f721b 100644
---- a/server/changelog/tagger.js
++++ b/server/changelog/tagger.js
@@@ -95,7 +95,10 @@ function createChangelogTagger({ config, fetchImpl = globalThis.fetch, log = con
          };
          const idempotency = crypto.createHash('sha256').update(input.entries.map((e) => `${e.service}:${e.id}`).join(',')).digest('hex');
          const answer = await run({
--            task: 'blog.changelog.tag', input,
++            // AI authorizes the workflow namespace before it can resolve the named task.
++            // Keep both fields: task selects the owner-chosen task configuration; workflow
++            // supplies the namespace-checked workflow key.
++            task: 'blog.changelog.tag', workflow: 'blog.changelog.tag', input,
              target: { service: 'blog', type: 'changelog', id: 'network' },
              idempotency_key: `changelog-tags:${idempotency}`,
          });
ddiff --git a/test/changelog-tags.test.js b/test/changelog-tags.test.js
iindex 78567c8..dbdfc34 100644
---- a/test/changelog-tags.test.js
++++ b/test/changelog-tags.test.js
@@@ -108,6 +108,7 @@ const { tagsFrom, parseLoose, createChangelogTagger } = require('../server/chang
          assert.strictEqual(tagger.enabled, true);
          const answer = await tagger.tag([{ id: 7, service: 'live', subject: 'Add a calmer chat (#9)', repo: 'OpenVibers/OpenVibe.Live' }]);
          assert.strictEqual(seen.run.body.task, 'blog.changelog.tag');
++        assert.strictEqual(seen.run.body.workflow, 'blog.changelog.tag', 'the AI API checks the workflow namespace before resolving the task');
          assert.strictEqual(seen.run.body.target.service, 'blog');
          assert.deepStrictEqual(seen.run.body.input.entries, [{ id: '7', service: 'live', subject: 'Add a calmer chat (#9)', repo: 'OpenVibers/OpenVibe.Live' }]);
          assert.match(seen.token, /audience=openvibe\.ai/);