[relayfile] Workspace selector lookup misses must not persist no-localDir stub records

[khaliqgant]

Companion to AgentWorkforce/factory#241 and related to #323.

Summary

A workspace selector lookup miss can flow through prepareWorkspaceCommandClient -> workspaceRecordForCommand -> upsertWorkspaceDetails. workspaceRecordForCommand synthesizes { Name: workspaceID, ID: workspaceID } when neither the typed name nor resolved id matches the local catalog, and delegated credential setup then persists that synthetic record. The result is a workspace named after an rw_ id with no localDir.

A lookup miss must be an error, not a catalog write.

Live evidence (2026-08-14)

The canonical workspace is name=default, id=rw_7ccfea89, with its mirror registered at chief/.integrations. The catalog also contains a second name=rw_7ccfea89, id=rw_7ccfea89 record with no localDir. During a supervised relayfile restart default --foreground verification, the daemon repeatedly emitted:

error: workspace rw_7ccfea89 has no recorded local mirror directory; run `relayfile start rw_7ccfea89 <LOCAL_DIR>` first to register one

The KeepAlive job restarted several times while this error recurred. Earlier cleanup removed three equivalent stubs; a Factory startup using the old per-repo CLI mount path recreated one immediately. Duplicate alias resolution also made Relayfile warn that the delegated credential workspace was not uniquely resolved and increased Factory ensureSubRoot latency from sub-second to 30s+.

Asked-for behavior

1. Resolve selectors against both workspace name and every id alias.
2. If no existing record matches, return a lookup error unless the caller explicitly requested workspace creation/setup.
3. Read/mount/status/restart paths must never call an upsert fallback on lookup miss.
4. Collapse or safely ignore existing id-named no-localDir stubs when a unique canonical record for the same workspace exists.

Definition of done

• Passing either default or rw_7ccfea89 resolves the same canonical record.
• Passing an unknown selector returns an error and leaves workspaces.json byte-for-byte unchanged.
• relayfile restart default --foreground does not resolve through an id-named no-localDir stub.
• Regression tests cover the prepareWorkspaceCommandClient delegated-credential path, not only resolveWorkspaceRecord.

Factory#241 now performs its own registry lookup read-only, but Relayfile owns the catalog mutation path and cleanup semantics.