Preserve explicit workspace in IDE device login

[miki3421]

Summary

• keep ops ide login namespace-free for backend-managed SSO device flow when no username is supplied
• preserve and forward an explicit ops ide login workspace to the CLI
• document that omitting lets the authenticated identity determine the namespace

Root cause

The device-flow branch cleared OPSDEV_USERNAME before checking the positional . This prevented stale persisted state from being forwarded, but it also discarded a workspace explicitly supplied by the user. In addition, the nested CLI process reloads persisted config, so environment-only clearing cannot reliably express whether a workspace was intentional.

The task now invokes the CLI with no positional user for implicit device login and with the positional user when one was explicitly selected. The companion CLI fix gives this argument precedence over persisted environment values.

Companion PR: apache/openserverless-cli#42

Validation

• task --taskfile ide/opsfile.yml --list
• isolated task invocation with stale OPS_USER=nuvolaris and OPSDEV_USERNAME=nuvolaris: captured CLI arguments are only -login
• isolated ops ide login michelem: captured CLI arguments are -login michelem
• git diff --check

The admin-api authenticated-namespace mismatch check is not changed or bypassed.