Our company just signed up with Workday and OKTA about the same time and currently have Workday profiled as a master as well. We're experiencing EXACTLY what you noted. I was wondering if anything has changed on this since you first brought it up? You mentioned that there is a flag, but I'm assuming it's on OKTA's side? If so, how did you apply that flag?
AFAIK - nothing has changed. The "profile_sync_user_reactivation"is a flag that only Okta support can turn on. It does not work for us since it requires that you have Okta set to auto reactivate deactivated accounts if Workday still shows the account as active. There are times that we need to override that -- so the fix does not work for us. Also, since a Contingent->Employee conversion in Workday always requires deactivating the old account & reactivating the new account, it seems to me like the deactivation would cause all of the assigned apps to get deprovisioned in Okta anyhow & that's what causes the majority of our problems (since some apps don't play nice with reactivating accounts).
It's possible that there is a better solution but I am not aware of it. It might be worthwhile for you to reach out to Okta to find out. If you do, let me know what you find out.