v4: Make WorkflowRemediation the sole public remediation API

[jtdub]

Description

Currently users can compute remediations two ways:

• WorkflowRemediation(running, generated).remediation_config
• running.config_to_get_to(generated)

Having two paths to the same result creates confusion and makes it harder to add cross-cutting concerns (caching, validation, logging).

Proposed Change

• Make HConfig.config_to_get_to() private (_config_to_get_to())
• WorkflowRemediation becomes the only public interface for remediation and rollback
• Add validation (e.g., driver compatibility check) to WorkflowRemediation.__init__()

Breaking Change

Yes — direct calls to config_to_get_to() must use WorkflowRemediation instead.