node up: prefer the repository workspace over stale global active state

[willwashburn]

Problem

agent-relay node up prefers the global workspace store's active entry over an
existing per-repository workspace-key.json.

That makes a repository with an explicit local workspace silently start in a
different, stale workspace after a restart.

Observed impact

On the 2026-07-30 fleet restart, chief was re-homed alone into a stale workspace
instead of the repository's configured workspace.

Evidence on the affected machine:

• chief journal for 2026-07-30
• ~/Library/Logs/chief-node.log records workspace-id prefixes d546 four
  times, followed by 370d
• only one of the expected 15 participants appeared with chief

No credential values should be copied into this issue or diagnostics.

Expected behavior

When a valid per-repository workspace-key.json exists, node up uses that
repository-local selection. A global active workspace must not silently
override it.

If resolution cannot safely choose one source, startup should fail with a
diagnostic that names the conflicting source locations without printing keys.

Acceptance criteria

• Define and document deterministic workspace-source precedence for node up.
• Prefer a valid per-repository workspace selection over the global active
  entry.
• Do not silently mint or select a different workspace when the local
  selection exists.
• Add a regression covering simultaneous local and global entries with
  different workspaces.
• Diagnostics identify which source won without exposing credential material.