Trim default_workflow and pin explicit-null bucket-default behavior

Trim the settings default_workflow before mapping to WorkflowIntent so a
whitespace-only value resolves to BucketDefault, matching the UI's
workflow_intent() and opt_from_string. Pin the explicit-null default_workflow
case and tighten the non-string-key assertion with a message check.

Author: fiskus

quilt-rs/src/io/remote/workflow.rs

@@ -461,6 +461,42 @@ workflows:
             err,
             Error::RemoteCatalog(RemoteCatalogError::Workflow(_))
         ));
+        assert!(err.to_string().contains("must be a string"));
+
+        Ok(())
+    }
+
+    #[test(tokio::test)]
+    async fn test_bucket_default_explicit_null_key() -> Res<()> {
+        let remote = MockRemote::default();
+        let host = None;
+        let uri: S3Uri = "s3://any/.quilt/workflows/config.yml".parse()?;
+
+        // `default_workflow:` with no value is a YAML explicit null — not a string,
+        // so the bucket-default intent errors loudly rather than governing silently.
+        //
+        // quilt3 agrees in direction: its config JSON schema types `default_workflow`
+        // as a string and quilt3 schema-validates the whole config on load, so this
+        // config fails every push there. quilt-rs rejecting only the bucket-default
+        // intent is the narrower behavior.
+        let config = r"
+default_workflow:
+workflows:
+  foo:
+    metadata_schema: bar
+";
+        remote
+            .put_object(&None, &uri, config.as_bytes().to_vec())
+            .await?;
+
+        let err = resolve_workflow(&remote, &host, WorkflowIntent::BucketDefault, &uri)
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            err,
+            Error::RemoteCatalog(RemoteCatalogError::Workflow(_))
+        ));
+        assert!(err.to_string().contains("must be a string"));
 
         Ok(())
     }

quilt-sync/src-tauri/src/model/ops.rs

@@ -215,9 +215,10 @@ pub async fn publish_with_settings(
         },
     );
     let metadata = settings.default_metadata.clone().unwrap_or_default();
-    // A missing or empty `default_workflow` means "no opinion" — honour the
-    // bucket's default workflow; a non-empty id enforces that named workflow.
-    let workflow = match settings.default_workflow.as_deref() {
+    // A missing, empty, or whitespace-only `default_workflow` means "no opinion"
+    // — honour the bucket's default workflow; a non-empty id (after trimming)
+    // enforces that named workflow.
+    let workflow = match settings.default_workflow.as_deref().map(str::trim) {
         Some(id) if !id.is_empty() => WorkflowIntent::Named(id.to_string()),
         _ => WorkflowIntent::BucketDefault,
     };
@@ -413,4 +414,17 @@ mod tests {
         publish_with_settings(&model, &namespace, &settings, status).await?;
         Ok(())
     }
+
+    #[tokio::test]
+    async fn publish_with_settings_whitespace_maps_to_bucket_default() -> Result<(), Error> {
+        let namespace: quilt_uri::Namespace = ("acme", "demo").into();
+        let model = model_expecting_intent(WorkflowIntent::BucketDefault);
+        let settings = PublishSettings {
+            default_workflow: Some("   ".into()),
+            ..PublishSettings::default()
+        };
+        let status = quilt::lineage::InstalledPackageStatus::default();
+        publish_with_settings(&model, &namespace, &settings, status).await?;
+        Ok(())
+    }
 }