Reject blank worker names and probe the real credential and venv in --check

coordinator/internal/domain/worker.go

@@ -1,6 +1,7 @@
 package domain
 
 import (
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -52,6 +53,10 @@ func NewWorker(name string, capabilities []string, now time.Time) (*Worker, erro
 	if len(capabilities) == 0 {
 		return nil, ErrInvalidInput
 	}
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return nil, ErrInvalidInput
+	}
 	return &Worker{
 		ID:              uuid.New(),
 		Name:            name,

coordinator/internal/domain/worker_test.go

@@ -29,3 +29,11 @@ func TestNewWorkerRejectsNoCapabilities(t *testing.T) {
 		t.Errorf("empty slice: err = %v, want ErrInvalidInput", err)
 	}
 }
+
+func TestNewWorkerRejectsBlankName(t *testing.T) {
+	for _, name := range []string{"", "   ", "\t\n"} {
+		if _, err := NewWorker(name, []string{"similarity-search"}, testNow); !errors.Is(err, ErrInvalidInput) {
+			t.Errorf("name %q: got %v, want ErrInvalidInput", name, err)
+		}
+	}
+}