fix(workflow): reject non-JoinNode fan-in at validation time

[wolo-lab]

Problem

In a diamond like Start → A, A → B, A → C, B → D, C → D where D is a plain node (not a JoinNode), D has two predecessors. When B and C each complete, the scheduler schedules D twice.
The scheduler keys its per-node bookkeeping (runsByName / runCancels) by node name and has no "already running" guard, so the second activation of D overwrites the first while it's still running:

• the first activation's cancel func is lost (leak / uncancellable),
• both activations accumulate into the same per-name run, mixing outputs → ErrMultipleOutputs / wrong output.
  JoinNode fan-in is safe (it's barrier-gated — it waits for all predecessors and gets the aggregated input), but nothing stopped a plain node from being used as a fan-in target, so the corruption happened silently.

How adk-python handles it (for context)

adk-python's v2 graph engine allows plain fan-in: it buffers a trigger per predecessor and serializes per-node execution (_schedule_ready_nodes skips a node already RUNNING), so a plain fan-in node runs once per trigger, never concurrently. adk-go has no such per-node serialization yet.

Solution

Rather than serialization, reject the unsupported graph at construction with a clear, honest error (ErrUnsupportedFanIn: "non-JoinNode fan-in is not yet supported ... use a JoinNode to converge branches"). This turns silent state corruption into a fail-fast build error, and the message signals it's a temporary limitation. When per-node serialization lands later, the check can be removed.

The check counts only unconditional (Route == nil) incoming edges, so it rejects exactly the diamond case while leaving legitimate graphs alone:

• loop-back (a conditional back-edge gives a node a 2nd predecessor, but they don't fire together) — allowed,
• conditional fan-in (only one branch routes in at a time) — allowed,
• JoinNode fan-in — exempt (barrier-gated).