fix: gate direct session creation by workspace policy

frontend/src/shell/SteerInput.test.tsx

@@ -22,6 +22,9 @@ test("new sessions send the browser-selected workspace, model, provider, and thi
     workspaceId: "psd-clinical", provider: "zai", model: "glm-5.2", thinking: "high",
   }));
   server.use(
+    http.get("http://localhost:8787/workspaces", () => HttpResponse.json([{
+      id: "psd-clinical", name: "psd-clinical", file: "psd-clinical.yaml", displayName: "PSD Clinical",
+    }])),
     http.post("http://localhost:8787/sessions", async ({ request }) => {
       body = await request.json();
       return HttpResponse.json({ id: "s1" });