Add workflow.SignalWithStartWorkflow via system Nexus

[dplyukhin]

What

Adds workflow.SignalWithStartWorkflow, backed by the built-in system Nexus
WorkflowService. The bindings are generated by nex-gen from a checked-in WIT and
re-exposed on the workflow package.

How

The nex-gen-generated api.go targets the public workflow/temporal/client
packages, all of which depend on internal. A generated package re-exported by
workflow would form an import cycle (workflow -> generated -> workflow).

internal/cmd/nexussystemgen runs nex-gen and rewrites the output via the Go
AST to target go.temporal.io/sdk/internal directly (the public packages are
thin aliases of internal, so this is identity-preserving), emitting
internal/nexussystem and the generated workflow/system_nexus_gen.go
forwarder. The resulting graph (workflow -> internal/nexussystem -> internal,
and workflow -> internal) is acyclic.

For the system endpoint, prepareNexusOperationParams encodes the envelope as
proto-binary (via the proto payload converter) rather than through the
workflow data converter — the default converter would produce json/protobuf,
but temporal-api-go's visitor requires binary/protobuf and reads the
messageType metadata to decode it. The envelope is not run through any codec;
api-go's visitor descends into the envelope's inner payloads so codecs / external
storage apply there. NewNexusClient now permits the system endpoint/service
pair despite the reserved __temporal_ prefix.

internal/extstore moves off the vendored internal/temporalapi/sdk/v1 to
go.temporal.io/api/sdk/v1, which now publishes ExternalStorageReference (per
that vendored package's own README migration note); this avoids a duplicate
proto-registration panic against the updated api-go.

Dependencies

• Recursively visit payloads inside ScheduleNexusOperationCommandAttributes when using system nexus api-go#290 (the payload-visitor change)
• Use proto-qualified service wire name for Go ServiceName nex-gen#49 (the Go generator; only needed when regenerating bindings)

⚠️ Temporary local replace

This branch includes replace go.temporal.io/api => ../temporal-api-go so it can
build against the unreleased api-go visitor change. This must be removed and
replaced with a released go.temporal.io/api version before merge.

Test plan

• go build ./...
• go test ./internal/... (full internal suite, plus internal/extstore,
  internal/nexussystem)
• New tests: internal/nexussystem/system_nexus_integration_test.go
  (end-to-end: request -> proto-binary envelope -> api-go visitor descends
  into inner payloads) and internal/system_nexus_client_test.go
  (NewNexusClient system-pair exemption)

Regeneration

NEX_GEN_BIN=<bin> DESCRIPTORS=<set.pb> make -C internal/nexussystem generate

[tconley1428]

I think we just want it as part of the root make file.