Request body for POST /v1/workflows/{uuid}/execute.
The trigger source is NOT a request field — it is derived server-side
from the API key's key_type (human or agent). Agent keys
must also provide reason and confidence for the approval gate.