feat: resolve workspace bindings into runtime configs

backend/src/tht/tht-runner.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { clearPrincipalEnvironment, principalEnvironment, type PrincipalContext } from "../auth/principal.js";
 import { secretValue, type SecretBundleConfig } from "../config/secret-bundle.js";
 
@@ -49,8 +49,13 @@ export class ThtRunner {
    * back to the default config would point every operation at the wrong workspace
    * (wrong DB, wrong sessions dir) — fail loud instead.
    */
-  private configArg(workspace?: string): string[] {
-    if (workspace) {
+  private configArg(workspaceConfigPath?: string): string[] {
+    if (workspaceConfigPath) {
+      if (isAbsolute(workspaceConfigPath)) return ["-c", workspaceConfigPath];
+      if (workspaceConfigPath.includes("/")) {
+        throw new Error("workspace snapshot config path must be absolute");
+      }
+      const workspace = workspaceConfigPath;
       if (!existsSync(join(this.cfg.harnessDir, "workspaces", `${workspace}.yaml`))) {
         throw new Error(`workspace non trovato: workspaces/${workspace}.yaml (harness: ${this.cfg.harnessDir})`);
       }