provisionApps processes ws2-workflow.yml last (EE mode), which calls
POST /workspaces/switch to secondaryWsId. The bearer token session then
has current_workspace = auto_test1.
Suite jobs sharing the same token inherit this state. When they call
describe?workspace_id=auto_test0 for hitl apps, the server returns 422:
'workspace_id does not match app's workspace'.
Fix: after provisionApps, switch back to primaryWsId so all subsequent
suite jobs start with the correct workspace context.