Pin gxwf to the workspace install + bump @galaxy-tool-util/cli to 1.10.0

[jmchilton]

Why

workflow-fixtures/scripts/build-iwc.sh invoked npx -p '@galaxy-tool-util/cli' gxwf with no version, so the generated IWC format2 corpus tracked whatever gxwf npx happened to resolve at build time — not the version pinned in package.json. An old gxwf leaked non-canonical output into all 120 fixtures:

• a top-level unique_tools: block (an in-memory-only derived field — not part of on-disk gxformat2; current gxwf strips it on serialize), and
• unquoted YAML-1.1 word-scalars (use_guide: no, which PyYAML decodes to boolean False instead of the string "no").

Current gxwf (1.8.2+) no longer emits either, so any re-serialization "changed" untouched regions — which shows up as spurious byte-stability churn for the update-in-place pipeline whose whole value prop is byte-stable untouched regions.

What

• build-iwc.sh: npx -p @galaxy-tool-util/cli gxwf → pnpm exec gxwf. Fixture-gen now runs the workspace-installed gxwf, so it tracks the package.json + pnpm-lock.yaml pin. Future bumps are edit-the-pin + pnpm install; no script edit.
• package.json: @galaxy-tool-util/cli ^1.8.1 → ^1.10.0 (latest); lockfile updated.

package.json is now the single source of truth for the gxwf version.

Verification

• npm run test — 145/145 pass on the bump.
• Regenerating iwc-format2 with 1.10.0: unique_tools present in 120/120 → 0/120; use_guide canonically quoted.
• draft-extract on a regenerated fixture is now a byte-identical round-trip (was dropping unique_tools / re-quoting before, purely because the on-disk fixture was stale).

Follow-ups (not in this PR)

• content/cli/gxwf/index.md and content/cli/galaxy-tool-cache/index.md still pin @1.8.1 in their invoke_fallback + prose (one line now falsely says it "tracks the ^1.8.1 devDependency"). These feed the runtime fallback baked into cast bundles — reconciling them means editing the notes → bump → recast the affected molds.
• The shared fixture mirror (~/projects/repositories/workflow-fixtures) is still on the old corpus; only local worktree fixtures were regenerated.

🤖 Generated with Claude Code