fix: remove remaining GRANT/REVOKE WORKFLOW references from docs and HELP

- Remove SHOW ACCESS ON WORKFLOW from HELP output
- Update workflows.md See Also to clarify access control approach
- Remove dead Workflow section from showSecurityMatrix (AllowedModuleRoles doesn't exist)

Author: engalar

docs-site/src/language/workflows.md

@@ -46,4 +46,4 @@ END WORKFLOW;
 - [Workflow Structure](./workflow-structure.md) -- full CREATE WORKFLOW syntax
 - [Activity Types](./workflow-activities.md) -- all workflow activity types
 - [Workflow vs Microflow](./workflow-vs-microflow.md) -- choosing between the two
-- [GRANT / REVOKE](./grant-revoke.md) -- granting execute access on workflows
+- [GRANT / REVOKE](./grant-revoke.md) -- workflow access is controlled through triggering microflows and UserTask targeting, not document-level roles

mdl/executor/cmd_misc.go

@@ -222,7 +222,6 @@ Security - Queries:
   SHOW DEMO USERS;
   SHOW ACCESS ON MICROFLOW Module.Name;
   SHOW ACCESS ON PAGE Module.Name;
-  SHOW ACCESS ON WORKFLOW Module.Name;
   SHOW ACCESS ON Module.Entity;
   SHOW SECURITY MATRIX [IN Module];
   DESCRIBE MODULE ROLE Module.Role;

mdl/executor/cmd_security.go

@@ -629,28 +629,6 @@ func (e *Executor) showSecurityMatrixJSON(moduleName string) error {
 		})
 	}
 
-	// Workflows
-	wfs, _ := e.reader.ListWorkflows()
-	for _, wf := range wfs {
-		if len(wf.AllowedModuleRoles) == 0 {
-			continue
-		}
-		modID := h.FindModuleID(wf.ContainerID)
-		modName := h.GetModuleName(modID)
-		if moduleName != "" && modName != moduleName {
-			continue
-		}
-		var roleStrs []string
-		for _, r := range wf.AllowedModuleRoles {
-			roleStrs = append(roleStrs, string(r))
-		}
-		tr.Rows = append(tr.Rows, []any{
-			"Workflow",
-			modName + "." + wf.Name,
-			strings.Join(roleStrs, ", "),
-			"X",
-		})
-	}
 
 	return e.writeResult(tr)
 }