fix(agent): defer config validation to call time

Bundle top-level code runs during `workflow add` (descriptor extraction),
but agent config env vars (e.g. WORKFLOW_HERMES_COMMAND) are only available
at `workflow run` time. Deferring validation prevents premature throws.

packages/workflow-agent-cursor/__tests__/cursor-agent.test.ts

@@ -101,27 +101,25 @@ describe("createCursorAgent", () => {
     expect(typeof agent).toBe("function");
   });
 
-  test("throws on invalid config at construction", () => {
-    expect(() =>
-      createCursorAgent({
-        command: "/usr/local/bin/cursor-agent",
-        model: null,
-        timeout: -1,
-        workspace: "/tmp/test-project",
-        llmProvider: null,
-      }),
-    ).toThrow();
+  test("defers validation to call time (invalid config does not throw at construction)", () => {
+    const agent = createCursorAgent({
+      command: "/usr/local/bin/cursor-agent",
+      model: null,
+      timeout: -1,
+      workspace: "/tmp/test-project",
+      llmProvider: null,
+    });
+    expect(typeof agent).toBe("function");
   });
 
-  test("throws when null workspace without llmProvider", () => {
-    expect(() =>
-      createCursorAgent({
-        command: "/usr/local/bin/cursor-agent",
-        model: null,
-        timeout: 0,
-        workspace: null,
-        llmProvider: null,
-      }),
-    ).toThrow();
+  test("defers validation — null workspace without llmProvider does not throw at construction", () => {
+    const agent = createCursorAgent({
+      command: "/usr/local/bin/cursor-agent",
+      model: null,
+      timeout: 0,
+      workspace: null,
+      llmProvider: null,
+    });
+    expect(typeof agent).toBe("function");
   });
 });

packages/workflow-agent-cursor/src/index.ts

@@ -30,16 +30,16 @@ function resolveCursorModel(model: string | null): string {
 
 /** Runs `cursor-agent` with workspace from config or extracted from context via LLM. */
 export function createCursorAgent(config: CursorAgentConfig): AgentFn {
-  const validated = validateCursorAgentConfig(config);
-  if (!validated.ok) {
-    throw new Error(validated.error);
-  }
-
   const modelFlag = resolveCursorModel(config.model);
   const timeoutMs = config.timeout > 0 ? config.timeout : null;
   const logger = createLogger({ sink: { kind: "stderr" } });
 
   return async (ctx) => {
+    const validated = validateCursorAgentConfig(config);
+    if (!validated.ok) {
+      throw new Error(validated.error);
+    }
+
     let workspace: string;
 
     if (config.workspace !== null) {

packages/workflow-agent-hermes/__tests__/hermes-agent.test.ts

@@ -37,11 +37,11 @@ describe("validateHermesAgentConfig", () => {
 });
 
 describe("createHermesAgent", () => {
-  test("returns an AgentFn", () => {
+  test("returns an AgentFn even with invalid config (validation deferred to call)", () => {
     const agent = createHermesAgent({
       command: "/usr/local/bin/hermes",
       model: null,
-      timeout: null,
+      timeout: -5,
     });
     expect(typeof agent).toBe("function");
   });

packages/workflow-agent-hermes/src/index.ts

@@ -26,14 +26,14 @@ function throwHermesSpawnError(error: SpawnCliError): never {
 
 /** Runs `hermes chat` non-interactively with the Nerve-style argv contract (`-q`, `--yolo`, `--quiet`). */
 export function createHermesAgent(config: HermesAgentConfig): AgentFn {
-  const validated = validateHermesAgentConfig(config);
-  if (!validated.ok) {
-    throw new Error(validated.error);
-  }
-
   const timeoutMs = config.timeout;
 
   return async (ctx) => {
+    const validated = validateHermesAgentConfig(config);
+    if (!validated.ok) {
+      throw new Error(validated.error);
+    }
+
     const fullPrompt = await buildAgentPrompt(ctx);
     const args = [
       "chat",