fix(ci): switch session back to primaryWsId after provision

provisionApps processes ws2-workflow.yml last (EE mode), which calls
POST /workspaces/switch to secondaryWsId. The bearer token session then
has current_workspace = auto_test1.

Suite jobs sharing the same token inherit this state. When they call
describe?workspace_id=auto_test0 for hitl apps, the server returns 422:
'workspace_id does not match app's workspace'.

Fix: after provisionApps, switch back to primaryWsId so all subsequent
suite jobs start with the correct workspace context.

cli/scripts/e2e-provision.ts

@@ -327,6 +327,18 @@ async function main() {
   const appIds = await provisionApps(cookieString, csrfToken, primaryWsId, secondaryWsId)
   console.warn(`[provision] Provisioned ${Object.keys(appIds).length} apps`)
 
+  // 4b. Switch back to primaryWsId so the session ends in the correct workspace.
+  //     provisionApps processes ws2-workflow.yml last (EE mode), leaving the server
+  //     session in secondaryWsId. Suite jobs that share this token would then have
+  //     their describe calls rejected with "workspace_id does not match app's workspace".
+  await fetch(`${base}/console/api/workspaces/switch`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Cookie': cookieString, 'X-CSRF-Token': csrfToken },
+    body: JSON.stringify({ tenant_id: primaryWsId }),
+    signal: AbortSignal.timeout(10_000),
+  }).catch((err: unknown) => console.warn(`[provision] switch-back to primary failed (non-fatal): ${err}`))
+  console.warn(`[provision] Session workspace reset to primary: ${primaryWsId}`)
+
   // 5. Write outputs
   await writeOutputs({
     DIFY_E2E_TOKEN: primaryToken,