Expose restartDuoWorkflow on the Duo workflow permission type

What does this MR do and why?

Adds the existing restartDuoWorkflow to the DuoWorkflowPermissions GraphQL type, with no behaviour change

• The permission depends on rules the frontend can't evaluate - workflow ownership, chat type, and project level, so it should be resolved on the backend
• This matches how the existing cancel action already works, since it also relies on a GraphQL permission (updateDuoWorkflow) on the same type to drive its enabled state

References

• Related to FE: Add retry button to sessions view when a se... (#598746 - closed) • Allison Villa • 19.6 • On track
• Related frontend MR: !257412 (merged)

Screenshots or screen recordings

No UI changes

How to set up and validate locally

1. Get a Duo Agent Platform session in a stopped state. ex. Run any flow in a project, then cancel it from the session details page

2. Find the workflow id, either from the session page URL or in the Rails console with Ai::DuoWorkflows::Workflow.last.id. Open http://gdk.test:3000/-/graphql-explorer and run:

   query {
     duoWorkflowWorkflows(workflowId: "gid://gitlab/Ai::DuoWorkflows::Workflow/<ID>") {
       edges {
         node {
           id
           status
           userPermissions {
             restartDuoWorkflow
           }
         }
       }
     }
   }

3. Confirm restartDuoWorkflow returns true for your stopped or failed session. As a negative check, run the same query against a running or finished session and confirm it returns false.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.