Fix SSO device-flow workspace selection

[miki3421]

Summary

• keep the backend-managed OIDC device request namespace-free unless the user supplies the positional workspace explicitly
• give explicit command-line workspace input precedence over OPS_USER and OPSDEV_USERNAME values reloaded from config.json
• preserve workspace binding when an explicit positional user is supplied
• accept empty configuration assignments such as OPSDEV_USERNAME= as documented by ops -config

Root cause

setAllConfigEnvVars() reloads persisted IDE values before LoginCmd() runs. The old OPSDEV_USERNAME=nuvolaris fallback was therefore passed as namespace to /system/api/v1/auth/oidc/device/start, even when the current device login did not request a workspace. A successful Keycloak login for michelem was then correctly rejected by admin-api because it did not match the stale requested namespace.

The admin-api namespace mismatch check is unchanged. This PR only distinguishes an explicit workspace request from persisted local fallback state.

Validation

• go test ./...
• go test ./auth ./config
• task itest T=config F="--formatter tap" (13/13)
• regression coverage verifies that stale OPS_USER/OPSDEV_USERNAME are absent from device start and poll payloads
• regression coverage verifies that an explicit positional workspace remains present in both payloads
• git diff --check

Follow-up

The companion apache/openserverless-task:0.9.1 PR updates ops ide login so an explicit <username> is forwarded positionally while the implicit device flow forwards no workspace. A new dev release must be tagged from Apache main only after these PRs are reviewed and merged.

[miki3421]

Companion task PR targeting the required 0.9.1 branch: apache/openserverless-task#212

[miki3421]

Release version is prepared inside this PR as 0.9.1-2607121109.dev. After the PR is merged, tag the reviewed Apache main commit as v0.9.1-2607121109.dev and push only that tag to trigger the release workflow. Do not run task tag, because the version bump is already part of the PR.