fix: infer persisted workflow in runtime guard

[scheno]

Reproduction

1. Create a change directory, run workflow accept <dir> --source direct-request --verification new-test, and confirm .spec-superflow.yaml persists workflow: quick.
2. Before this change, run runtime guard check <dir> exploring approved-for-build --json without --workflow; it is evaluated as full and rejected. Passing --workflow quick succeeds.

Root cause

runGuard() registered --workflow with a default of full, so absence of the option was indistinguishable from an explicit Full request and the persisted workflow was never consulted.

Fix

• Treat an omitted --workflow as unspecified.
• Infer a valid persisted workflow from the change directory state; preserve explicit option precedence and retain full as the fallback for missing or invalid persisted values.
• Document the optional --workflow <mode> runtime-guard argument.

Tests

• Added regression: infers a persisted Quick workflow when runtime guard omits --workflow.
• node --test --test-name-pattern="infers a persisted Quick workflow" tests/lib/cmd-workflow.test.mjs passes.
• node --test tests/lib/cmd-workflow.test.mjs tests/lib/guard.test.mjs tests/lib/cmd-runtime.test.mjs passes: 88 passed, 0 failed, 2 skipped.
• npm run build passes.
• Full npm test on Windows still has the pre-existing unrelated baseline failures in hooks/session-start, task-brief, and token-baseline: comparison.

Conclusions for the two observations

1. Persisted Quick guard behavior: confirmed upstream CLI defect; fixed by this PR.
2. Windows state value with spaces/Chinese: not an upstream CLI truncation defect. A real cmd.exe invocation with "pass: ..." round-trips correctly. A stored test_result: "pass means the host/shell serialization passed literal "pass as argv, before the CLI received it; no code change is included for this observation.

[MageByte-Zero]

The core defect is reproducible on the latest main, and the persisted-workflow inference is the right fix. I also cherry-picked this commit onto the latest main; the full suite passed (846 tests), along with build, artifact validation, and version checks.

One error-path regression should be fixed before merge:

Important — validate required positionals before reading persisted state

In scripts/guard/guard.mjs, resolveWorkflow(changeDir, values.workflow) runs before the changeDir / fromState / toState presence check. With this PR, running:

ssf runtime guard check

changes from the existing usage error with exit code 2 to:

Guard error: The "path" argument must be of type string. Received undefined

with exit code 1, because readState(undefined) is reached first.

Please move the required positional validation before resolveWorkflow(), then add a regression assertion for the usage text and exit code 2. It would also be useful to keep both guard usage strings aligned by including [--workflow <mode>].

Once that small correction is made and the branch is updated from main, this PR has clear merge value.

[scheno]

The requested error-path correction is now implemented in follow-up commit 4a4ce7a:

• Required change-dir / from-state / to-state validation runs before resolveWorkflow() reads persisted state.
• ssf runtime guard check prints Usage and exits with code 2, rather than the internal path error/code 1.
• Both guard usage paths include [--workflow <mode>] [--json]; the header usage is aligned as well.
• Public-CLI regressions cover missing required positionals (including an invalid workflow combined with missing positionals) and the invalid-subcommand usage path.
• Persisted Quick inference, explicit workflow precedence, and Full fallback are unchanged. The branch includes the main merge at 229c25c.

Verification on Windows with Node v22.22.0:

• TDD: before the production edit, four new missing-positional regressions failed for the reviewed issues; afterward the same usage-focused run passed all five cases (the invalid-subcommand case already passed before the edit).
• node --test tests/lib/cmd-workflow.test.mjs tests/lib/guard.test.mjs tests/lib/cmd-runtime.test.mjs: 93 passed, 0 failed, 2 skipped, including persisted Quick inference.
• npm run build, npm run validate, and npm run check-versions: passed.
• git diff --check: passed. No version, dependency, or generated dist/ changes are included in this follow-up.
• Final pre-commit focused Usage + persisted-Quick verification: 6 passed, 0 failed.
• Independent read-only review of the complete PR plus follow-up: no blocking code findings.

Full Windows npm test is not clean: 851 tests, 834 passed, 5 failed, 12 skipped. All five failing cases were also reproduced against an unmodified archive of the pre-follow-up commit 229c25c:

• Two hooks/session-start output format cases: local Bash cannot resolve the Windows script path.
• Two task-brief cases: the same Windows/Bash path boundary.
• token-baseline: comparison / missing file in baseline reports error: Windows cmd does not recognize the POSIX true used by the test.

These existing environment/test portability failures are unchanged and kept outside this focused correction; I am not claiming a passing full suite for the new revision.

@MageByte-Zero Please re-review the required-positionals correction and the new regressions.