Reject newly unidentified or incompatible agents during runs

Revalidate explicit version and compatibility failures before invoking an active run or reusing its snapshot. Checked workspace and catalog tests and desktop pack.

desktop/src/workspace/local-workspace-agent-invocation.cjs

@@ -342,6 +342,7 @@ class LocalWorkspaceAgentInvocation {
     const runtimeBlocked = runtime?.credentialState === 'missing'
       || this.isProjectAuthBlocked(kind, group.workdir)
     const usable = item => item.installed !== false && item.invocable !== false
+      && item.versionIdentified !== false && item.compatible !== false
       && item.runtimePrerequisitesReady !== false && !item.runtimeBlockSource
       && item.compatibilityState !== 'incompatible' && item.credentialState !== 'missing'
       && !['runtime-auth-failure', 'none'].includes(item.availabilitySource)

desktop/test/workspace/local-workspace.test.cjs

@@ -493,6 +493,8 @@ test('an active run cannot bypass newly failed Agent prerequisites or reuse a bl
   workspace.activeRuns.set(group.id, { runId: 'run-readiness', targetKinds: ['codex'] })
   for (const blocked of [
     { invocable: false },
+    { versionIdentified: false },
+    { compatible: false },
     { runtimePrerequisitesReady: false },
     { runtimeBlockSource: 'workbuddy-model-unavailable' },
     { credentialState: 'missing' },