useSubscription:true is undeployable via CLI, fails late (after connect) and dry-run misses it

[khaliqgant]

Summary

useSubscription: true personas can't be deployed via the agentworkforce CLI, and the failure is late + messy: it surfaces after integrations are connected, and --dry-run doesn't catch it. Authors get a green dry-run, then a real deploy that half-connects providers before throwing an internal-sounding error.

Repro (CLI agentworkforce, persona with useSubscription: true + ctx.llm):

$ agentworkforce deploy ./linear-assistant/persona.json --mode cloud
integrations.slack: already connected
Connect linear now? (opens browser) [Y/n] y
linear connected.
integrations.linear: connected (…)
agentworkforce deploy failed: persona has useSubscription:true but no subscription resolver was supplied to the deploy orchestrator

Note Linear got connected as a side effect, then it failed.

Root cause

• packages/cli/src/deploy-command.ts runDeploy calls deploy(parsed, { authRecovery }) — it never passes a subscription resolver, so resolvers.subscription is always undefined.
• packages/deploy/src/connect.ts only checks this inside the connect phase: if (input.persona.useSubscription) { if (!input.subscription) throw 'no subscription resolver…' } — which runs after other integrations are already connected.
• --dry-run skips the connect phase, so the check never runs → dry-run reports ok for a persona that cannot actually deploy.

Net: useSubscription:true is effectively undeployable through the CLI today (no --harness-source value changes this, since the resolver is never wired), yet shipped personas use it (examples/review-agent/persona.ts, and the agents showcase linear/granola).

Requests

1. Validate in preflight / dry-run, before side effects. Move the useSubscription ⇒ subscription-resolver requirement into preflightPersona (or an early check in deploy) so --dry-run fails too and no integration is connected before the fatal error.
2. Make it deployable or fail fast with guidance. Either wire a subscription resolver in the CLI (e.g. via --harness-source oauth|byok → connectProvider), or, if unsupported, throw early with an actionable message: "useSubscription:true requires a connected LLM provider; pass --harness-source oauth (or remove useSubscription to use workforce-billed inference)."
3. Don't connect integrations before a known-fatal check. Order the resolver check ahead of connectIntegration so a doomed deploy doesn't leave providers half-connected.

Workaround we used: drop useSubscription (fall back to workforce-billed Claude via the persona's harness/model). Related: #149 / #150 (deploy preflight + persona loading).