Make workspace creation an explicit act when no source resolves (follow-up to #1378)

[willwashburn]

Follow-up to #1378, carved out of #1412.

#1412 fixed the reported symptom by adding the machine-global store as step 4 of the workspace precedence ladder, so a fresh directory now joins the machine's active workspace instead of creating a new one. It also made creation observable: startup prints Workspace: created new workspace <id> rather than output identical to a join.

What it did not do is #1378's stricter clause:

Join the account's active workspace when one exists, or stop and require an explicit choice (--workspace-key / interactive confirm on a TTY). Minting should be an explicit act, never a silent default.

When nothing resolves — no flag, no env, no repository pin, and no active entry in ~/.agentworkforce/relay/workspaces.json — the broker still creates a workspace without asking. That was a deliberate call: hard-failing there breaks first-run agent-relay up for every new user and any CI job that relied on auto-creation. Creation is now announced, not silent, which is why #1378 was closed on the symptom.

Remaining work

• Confirm before creating on a TTY. Prompt on an interactive terminal; keep creating without a prompt when stdin is not a TTY (CI, scripts, and the --background child, which is spawned with stdio: 'ignore'). The prompt has to be hoisted into runUpCommand before the detached fork — the decision currently happens inside the Rust broker child, where no TTY interaction is possible.
• Join by name instead of creating. lookup_workspace(name) → GET /v1/workspaces/by-name/{name} already exists in the relaycast crate and is never called from crates/broker/src. startup_single_session_set_from_sources (crates/broker/src/relaycast/auth.rs) goes straight to create_workspace() when no key candidate resolves, and the 409 name-conflict handler appends a random UUID suffix and creates anyway rather than joining the existing workspace.
• Offer a real choice from the account's workspaces. agent-relay cloud workspaces shipped in 11.4.0 and lists what the stored login can use — the account-level listing First node up in a fresh directory silently mints a new workspace instead of joining the account's active one #1378 noted was missing now exists, so an interactive picker is newly feasible.

Notes

• Any prompt must not regress the precedence ladder documented in packages/cli/README.md ("Which workspace a broker joins"): it only ever applies at the last rung, after flag/env/repository pin/machine-global active have all missed.
• The enrollment path is a separate axis — RELAY_NODE_TOKEN selects node identity, not workspace — and must stay off the ladder.