#467 Support --input flags on workflow resume for elevated permissions and runtime overrides

Follow-up from #369 (manual_approval steps).

When resuming a suspended workflow after approval, the operator may need to pass additional inputs that weren't available at the original run time — elevated credentials, environment-specific overrides, or runtime parameters that change between the suspend and resume phases.

Example use case: a Tailscale rollout workflow suspends after bootstrap for SSH verification. When resuming for the harden phase, the operator needs to pass a fresh auth key that was minted during the verification window.

swamp workflow resume deploy-with-gate --input authKey=tskey-abc123

Currently swamp workflow resume does not accept --input flags. The resume path rebuilds the expression context from disk but doesn't merge in new inputs. Adding --input support would allow the resumed execution to access both the original workflow inputs and the new override inputs via CEL expressions.

Considerations:

• Should new inputs override original inputs or be additive?
• Should the run record capture which inputs were added at resume time for audit?