Add Workday DA package discovery

[Surendra Goutham (is-goutham)]

Summary

Adds architecture-safe Workday DA discovery without enabling the later setup workflow:

• detects the Workday child package for ESS Declarative Agents
• recognizes current MOS and legacy DA schema aliases
• scopes Workday validation to the active agent
• exposes DA validation as an explicit opt-in FlightCheck scope
• prevents DA agents from entering the CEA package lifecycle

This is replacement PR 4 of the PR #290 split and is stacked on #302.

Validation

• 105 focused tests passed
• git diff --check

[nkemms]

Verdict: do not merge.

Findings

• MAJOR — solutions/ess-maker-skills/scripts/flightcheck/checks/workday_da.py:133-159 hard-fails any DA IT workspace, but the repo’s own catalog still lists CopilotForEmployeeSelfServiceDAIT / msdyn_EssDAITWorkday as a supported DA Workday bundle (skills/_shared/solution-catalog.md:27-28, skills/_shared/package-dependency-and-connection-catalog.md:52-55). That blocks a supported install path.
• MAJOR — solutions/ess-maker-skills/scripts/flightcheck/checks/_workday_app_assignment.py:101-102 introduces an explicit _connectConfigPath override, but nothing in this PR threads that marker into runner.config/callers, so the new split-path config contract is never exercised and the helper still falls back to .local/connect/workday/config.json. The DA/CEA config separation in src/skills/connect/step1.md:211-244 therefore isn’t actually enforced.

[Surendra Goutham (is-goutham)]

Reviewed both findings against the updated stack. The _connectConfigPath concern is covered by the #301 base plumbing and its regression tests, now propagated here. The DA IT rejection is intentional: this Workday setup path is scoped to the ESS HR agent and the later orchestration explicitly rejects DA IT rather than claiming setup support it cannot complete. The catalog paths cited in the review are not present in this PR/base, and the only implemented DA Workday package/install/orchestration contracts in this stack are HR-specific, so enabling DA IT discovery here would create a false supported route.

[nkemms]

Updated review findings — merge blockers remain

• Major — package presence is not tied to the selected active agent. WD-DA-PKG-001 can pass when the selected agent is missing, CEA, or otherwise unrelated, provided environment-wide DA HR parent/child packages exist. Require evidence that the selected active agent is the supported DA HR agent before its package result can pass.
• Major — selected-agent filesystem scope is not safely bounded. The workday_extension.py selected-agent path lacks strict component/containment validation, and an empty scope broadens back to all agents. Reject malformed or unresolved explicit scope and require the resolved agent path to remain inside the agents workspace.

[nkemms]

Re-reviewed the current head (5eec6da) against its stacked base. Two selected-agent blockers remain:

• WD-DA-PKG-001 ignores the explicitly selected agent — solutions/ess-maker-skills/scripts/flightcheck/checks/workday_da.py:113-176 re-derives identity from config instead of preferring runner.agent_slug. It can validate the wrong agent, and can pass from environment-wide package presence without proving which selected agent the package supports. Resolve the canonical selected slug first and fail closed when its identity cannot be established.
• The selected slug is used as an unconstrained filesystem path — scripts/flightcheck/checks/workday_extension.py:586-615 joins agent_slug directly beneath workspace/agents; traversal or absolute values can inspect another tree, and an unresolved slug broadens to all agents. Require a single safe path segment, verify containment after resolution, and do not broaden an explicitly scoped check.

The current tests cover benign single-agent inputs but not explicit-slug/config disagreement, unresolved selection, or hostile path values.

[Surendra Goutham (is-goutham)]

Addressed the latest blockers in 70fbc86: WD-DA-PKG-001 now prefers runner.agent_slug, resolves the matching canonical agent, rejects malformed/unresolved selections, and no longer infers support from environment-wide packages. Validation: 830 targeted tests passed.

[nkemms]

Re-reviewed the latest head (70fbc86). Package validation now requires the explicitly selected agent, rejects unresolved or unsupported identities, chooses the package from that agent's schema, and uses contained agent paths.

I found no remaining critical blocker. Good to merge.