Governed Workflow: Zero-Trust Orchestration for Claude Code