fix: close VCS workflow acceptance gaps

src/workflow-engine.ts

@@ -278,7 +278,7 @@ export async function resolveVcsSelection(
   // Load config from every distinct candidate root
   const configs = new Map<string, { vcs?: VcsKind; root: string }>();
 
-  for (const [vcsType, root] of Object.entries(candidates) as Array<[string, string | undefined]>) {
+  for (const [, root] of Object.entries(candidates) as Array<[string, string | undefined]>) {
     if (!root) continue;
 
     // Skip if we already loaded config from this root
@@ -288,15 +288,23 @@ export async function resolveVcsSelection(
       const config = resolveWorkflowConfig(root, {});
       configs.set(root, { vcs: config.vcs, root });
     } catch (err) {
-      // Re-throw validation errors, tolerate missing config
+      // Re-throw validation/parse errors (WorkflowConfigError) — these are real problems
       if (err instanceof WorkflowConfigError) {
         throw new WorkflowEngineError(`Invalid agent-workflow.json at ${root}: ${(err as WorkflowConfigError).message}`);
       }
-      // Config doesn't exist - that's ok
-      configs.set(root, { root });
+      // Re-throw file access errors unless the file simply doesn't exist (ENOENT).
+      // Permission denied, I/O errors, generic Error/TypeError, etc. must surface rather than be silently ignored.
+      const errCode = (err as any)?.code;
+      if (errCode === "ENOENT") {
+        // Config file doesn't exist — that's ok, treat as no project config
+        configs.set(root, { root });
+      } else {
+        throw err;
+      }
     }
   }
 
+
   // Extract project defaultVcs settings
   const projectDefaults = Array.from(configs.values())
     .map(c => c.vcs)