fix(evidence): isolate vectors by workspace

harness/tht/vectorstore/rest_client.py

@@ -128,13 +128,16 @@ class VectorRestClient:
             return len(payload)
         return len(rows)
 
-    def delete_generation(self, table_name: str, generation: str) -> int:
+    def delete_generation(self, table_name: str, generation: str, workspace_id: str) -> int:
         if table_name != "evidence" or re.fullmatch(r"gen:[0-9a-f]{32}", generation) is None:
             raise ValueError("generation must be canonical")
+        if re.fullmatch(r"[a-z][a-z0-9_-]{0,63}", workspace_id) is None:
+            raise ValueError("workspace namespace must be canonical")
         try:
             payload = self._call(
                 "delete_vector_generation",
-                {"table_name": table_name, "kind": "evidence", "generation": generation},
+                {"table_name": table_name, "kind": "evidence", "generation": generation,
+                 "workspace_id": workspace_id},
             )
         except VectorRestError as error:
             if "HTTP 404" in str(error):
@@ -146,11 +149,13 @@ class VectorRestClient:
             return int(payload.get("deleted", 0))
         return 0
 
-    def list_evidence_generations(self, table_name: str) -> list[str]:
+    def list_evidence_generations(self, table_name: str, workspace_id: str) -> list[str]:
+        if re.fullmatch(r"[a-z][a-z0-9_-]{0,63}", workspace_id) is None:
+            raise ValueError("workspace namespace must be canonical")
         try:
             rows = self._call(
                 "list_evidence_generations",
-                {"table_name": table_name, "kind": "evidence"},
+                {"table_name": table_name, "kind": "evidence", "workspace_id": workspace_id},
             ) or []
         except VectorRestError as error:
             if "HTTP 404" in str(error):