feat(cli): per-flow artifact folders + single-flow manifest

[proksh]

Note (folded into #3343): This PR was not merged to main independently. Its branch feat/cli-per-flow-artifact-folders was fast-forward merged into its base branch feat/orchestra-artifact-manifest (#3343), so #3343 now carries this per-flow-folder + single-flow-manifest work together with the typed-manifest change. GitHub auto-closed this PR as "merged" because its commits now live in its base. Review and land this work as part of #3343. The follow-up device-log work branches off #3343.

---

Stacked on the artifact-manifest PR. Restructures the CLI's debug output from a flat session dir into per-flow folders, and migrates the single-flow run path so it produces a manifest too.

Why

Today the CLI flattens every flow's artifacts into one ~/.maestro/tests/<ts>/ dir with flow-suffixed names (commands-(login).json), so a large multi-flow upload is an unreadable pile, the per-flow manifest.json clobbers (only the last flow survives), and a single-flow maestro test x.yaml produces no manifest at all (it ran through the un-migrated runSingle/saveFlow path).

What

• Per-flow folders. Each flow's canonical bundle is copied wholesale into ~/.maestro/tests/<ts>/<flow>/ with clean names. New TestDebugReporter.copyBundleToFlowDir (recursive copy; folder = sanitized flow name, -shard-N when sharded, -N on collision) replaces copyToFlatLayout (deleted, along with its rename + manifest-rewrite machinery). The manifest's relative paths are already correct, so it's copied verbatim — no rewriting.
• Single-flow migration. MaestroCommandRunner.runCommands gains artifactsDir and returns Orchestra.FlowResult; runSingle now produces a bundle and writes a per-flow folder + manifest, just like the suite path. saveFlow is removed (its only caller). runContinuous is unchanged (artifactsDir = null).
• Screenshot ownership. ArtifactsGenerator owns the failure screenshot (into the bundle); MaestroCommandRunner drops only its onCommandFailed capture but keeps WARNED + analyze per-command captures, which runSingle persists into the flow folder via persistDebugScreenshots — so no duplicate failure shot, and analyze/warned coverage is preserved.

Result (verified on a real iOS sim)

• maestro test single.yaml → <ts>/single/{commands.json, maestro.log, manifest.json, screenshot-❌-*.png} — manifest now present (COMMAND_METADATA, MAESTRO_LOG, SCREENSHOT).
• maestro test <workspace> → <ts>/flow_a/ and <ts>/flow_b/, each with its own manifest.json — no clobber.

Notes / for reviewer

• This changes the ~/.maestro/tests/ layout (flat → nested) and does the runSingle → listener/artifactsDir migration that feat: orchestra artifacts listener API + CLI migration (Phase 0+1) #3282 deferred — both squarely in your area, flagging for awareness.
• Layout consumers are unaffected: TestAnalysisManager.processDebugFiles uses a recursive Files.walk and matches by filename; the MCP logsDir and CloudInteractor use the session root.
• --flatten-debug-output (root-location) semantics unchanged.
• Device/session logs (root maestro.log from LogConfig, the driver's xctest_runner.log) remain session-level and are not in the per-flow manifest — they're produced below Orchestra; unifying those is a separate device-artifact-seam follow-up.

Tests

• :maestro-cli:test green (new copyBundleToFlowDir + persistDebugScreenshots tests; old copyToFlatLayout/saveFlow tests removed).
• Manual: single + suite runs verified on iphone_11_ios_17.