fix(workflows): reject explicit empty --from URL instead of catalog fallback

'workflow add foo --from ""' fell through 'from_url or ...' to a
catalog install. Distinguish None from empty string so explicit values
stay on the URL-validation path and fail closed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/specify_cli/workflows/_commands.py

@@ -713,8 +713,10 @@ def workflow_add(
 
     # Try as URL (http/https) — either the positional source is a URL, or an
     # explicit --from URL names where to fetch it (mirrors `extension add --from`).
-    download_url = from_url or (
-        source if source.startswith(("http://", "https://")) else None
+    download_url = (
+        from_url
+        if from_url is not None
+        else (source if source.startswith(("http://", "https://")) else None)
     )
     if download_url is not None:
         from ipaddress import ip_address

tests/test_workflows.py

@@ -7394,6 +7394,19 @@ steps:
         assert "does not match" in result.output
         assert not WorkflowRegistry(project_dir).is_installed("align-wf")
 
+    def test_add_from_empty_url_rejected_not_catalog_fallback(self, project_dir, monkeypatch):
+        """--from "" must fail URL validation, not silently install from the catalog."""
+        from typer.testing import CliRunner
+        from specify_cli import app
+        from specify_cli.workflows.catalog import WorkflowRegistry
+
+        monkeypatch.chdir(project_dir)
+        runner = CliRunner()
+        result = runner.invoke(app, ["workflow", "add", "align-wf", "--from", ""])
+        assert result.exit_code != 0
+        assert "HTTPS" in result.output
+        assert not WorkflowRegistry(project_dir).is_installed("align-wf")
+
     def test_add_from_url_non_https_redirect_escapes_rich_markup(self, project_dir, monkeypatch):
         """A redirect to a non-HTTPS IPv6 literal (legally bracketed) must not be parsed as Rich markup."""
         from unittest.mock import patch