n8n: store cleaned workflow definitions as repo source of truth

Move the two live-validated workflows into n8n/workflows/ (credential-
based auth referenced by name only, no secret values), add a manifest
covering all 4 canonical workflows and a read-only drift-check script
against n8n's Public API. Retire the pre-integration root-level starter
files that still carried the literal-token pattern, and repoint the
Unraid deploy scripts, Makefile targets and runbook at the new files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

n8n/README.md

@@ -1,13 +1,19 @@
 # n8n workflows
 
-`mobilityops-return-processing.json` is a starter import for the required live workflow.
+Canonical, live-validated workflow definitions live under `n8n/workflows/`. Each file is a
+cleaned export (secret values replaced by named-credential references, never literal
+tokens) of the workflow actually running on `https://n8n.itworx.tech`. See
+`n8n/workflows/MANIFEST.md` for the authoritative list: canonical name, purpose, trigger,
+required credentials, live workflow ID, active status and a checksum of each file.
 
-Before final validation Claude must:
+The two pre-integration starter files that used to live directly under `n8n/`
+(`mobilityops-return-processing.json`, `mobilityops-scheduled-quality-scan.json`) have been
+retired — they predate the live n8n validation pass and embedded the service token as a
+literal header value instead of a Header Auth credential. Do not resurrect them; the
+`n8n/workflows/` versions are the superseding source of truth and are what
+`deploy/unraid/setup-existing-n8n.sh` / `setup-scheduled-scan.sh` import.
 
-1. import or provision the workflow;
-2. configure a service credential for the MobilityOps callback;
-3. activate the webhook;
-4. ensure event ID is used as the idempotency key;
-5. validate online success and offline retry behaviour.
-
-The callback URL in the starter file is intentionally environment-driven and may require an n8n expression or credential adjustment.
+Deploying a workflow from these files into a fresh or existing n8n instance still requires a
+one-time manual step: create the named Header Auth credentials in the n8n UI (see each
+workflow's `credentials` block and the manifest) before publishing. This is deliberate —
+credential values are never committed to the repository.