fix(ci): write decide-mode output to /workspace emptyDir not /tmp

Argo's executor reads a valueFrom.path output parameter from a mounted
volume, not the container rootfs -> /tmp/mode gave 'no such file or
directory'. /workspace is the shared emptyDir the step already mounts.

infra/argo/fxhnt-cockpit-workflowtemplate.yaml

@@ -47,7 +47,7 @@ spec:
       outputs:
         parameters:
           - name: mode
-            valueFrom: { path: /tmp/mode }
+            valueFrom: { path: /workspace/mode }
       container:
         image: alpine/git:latest
         command: [/bin/sh, -c]
@@ -70,22 +70,22 @@ spec:
             cd /workspace/src && git checkout "$COMMIT_SHA"
 
             if [ "$MODE" != "auto" ]; then
-              printf '%s' "$MODE" > /tmp/mode
+              printf '%s' "$MODE" > /workspace/mode
             else
               RESOLVED="$(git rev-parse "$COMMIT_SHA")"
               if CHANGED=$(git diff --name-only "${RESOLVED}~1" "${RESOLVED}" 2>/dev/null); then
                 # diff succeeded (parent exists): build only if a dep/Dockerfile file changed, else deploy.
                 if echo "$CHANGED" | grep -qE '^pyproject\.toml$|^infra/docker/fxhnt\.Dockerfile$'; then
-                  printf 'build' > /tmp/mode
+                  printf 'build' > /workspace/mode
                 else
-                  printf 'deploy' > /tmp/mode
+                  printf 'deploy' > /workspace/mode
                 fi
               else
                 # diff failed (no parent -- first commit / shallow history): default to build (safe, never wrong).
-                printf 'build' > /tmp/mode
+                printf 'build' > /workspace/mode
               fi
             fi
-            cat /tmp/mode
+            cat /workspace/mode
         volumeMounts:
           - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
           - { name: workspace, mountPath: /workspace }