chore: release 5.3.1 - #119

Promote from dev to stable:

• fix(cloud): exclude config-shaped files from flow discovery (fix(cloud): exclude config-shaped files from flow discovery #114, closes dcd-cli#99) — a config.yaml sitting in a flows folder was picked up as a flow and blew up processDependencies with "Expected an array of steps". Detection is by shape, not filename, so several named configs can coexist in one folder. A flow merely missing its --- separator still errors loudly rather than being silently dropped.
• fix(cloud): reject malformed executionOrder instead of silently running in parallel (fix(cloud): reject malformed executionOrder instead of silently runni… #117, closes dcd-cli#110) — the config was yaml.loaded and straight-cast, so an executionOrder in the wrong shape was ignored and every flow ran in parallel. A zod schema (src/services/workspace-config.schema.ts) is now the single source of truth, with IWorkspaceConfig inferred from it so the compile-time and runtime views cannot drift.
• deps: bump the minor-and-patch group with 5 updates (deps: bump the minor-and-patch group with 5 updates #112), plus eslint-plugin-unicorn 72 -> 73 and pnpm/action-setup 6.0.9 -> 6.0.10.

Behaviour changes users will notice:

• A malformed executionOrder is now a hard error with a targeted message showing found-vs-expected. Anyone whose config was mis-shaped has been running flows in parallel without knowing; after this they get a clear failure instead. That is the point of the fix, but it is the one change that can turn a previously-green pipeline red.
• Unrecognised top-level config keys emit a warning (with a did-you-mean for near-misses). Keys are preserved, not stripped — the config is forwarded to the API as fields.workspaceConfig, so stripping would silently alter the payload.
• Config warnings go to stderr, so --json stdout stays parseable and the MCP server's JSON-RPC stdout channel stays clean.

No platform prerequisite: both fixes are client-side (flow discovery and config validation). The submitted payload for an already-valid config is unchanged.

Carries only the source delta — package.json version, CHANGELOG.md and the release-please manifests stay as release-please left them on production.

Release-As: 5.3.1

What & why

Type of change

• fix — bug fix
• feat — new feature
• perf — performance improvement
• refactor — code change that's neither a fix nor a feature
• docs — documentation only
• chore / ci / build / test — tooling, no user-facing change
• Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

• PR title follows the Conventional Commits format (see comment above)
• pnpm lint passes
• pnpm typecheck passes
• pnpm build passes
• I have not bumped the version or edited CHANGELOG.md (release-please handles this)
• I have signed the CLA (the bot will prompt on first contribution)
• Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test