refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a) (#208)

compliance-agent/src/pipeline/orchestrator.rs

@@ -587,7 +587,7 @@ impl PipelineOrchestrator {
                 let path = ingest_set
                     .get(&a.id)
                     .and_then(|ia| ia.working_path.clone())?;
-                crate::pipeline::plc::runtime::extract_program(&path)
+                werkbank_exec::plc::extract_program(&path)
             });
         let Some(program) = program else {
             tracing::info!(
@@ -597,10 +597,9 @@ impl PipelineOrchestrator {
             return Ok(0);
         };
 
-        let http = crate::pipeline::plc::runtime::http_client()?;
-        let provisioner =
-            crate::pipeline::plc::runtime::DockerSoftPlc::new(self.config.plc_runtime.clone());
-        let outcome = crate::pipeline::plc::runtime::provision_and_test(
+        let http = werkbank_exec::plc::http_client()?;
+        let provisioner = werkbank_exec::plc::DockerSoftPlc::new(self.config.plc_runtime.clone());
+        let outcome = werkbank_exec::plc::provision_and_test(
             &provisioner,
             &http,
             &self.config.plc_runtime,
@@ -663,7 +662,7 @@ impl PipelineOrchestrator {
         };
         // Short per-request budget so an unreachable device doesn't stall the scan.
         let budget = std::time::Duration::from_secs(5);
-        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
+        let findings = werkbank_exec::ics::probe_target(&endpoint, target_id, budget).await;
         tracing::info!(
             target_id,
             endpoint = %endpoint,