feat: consolidate database management work

Add catalog-owned logical relationships and runtime snapshots, extend the database-management UI and validation coverage, and document the updated operational workflow.

Keep active sensitive-generation status in a tooltip and indicator, and update the layout E2E to follow the history action in its new database-scoped location.

backend/src/tht/tht-runner.ts

@@ -213,23 +213,37 @@ export class ThtRunner {
   }
 
   /** Render one immutable canonical registry revision into a backend-owned harness config. */
-  acquireWorkspaceRuntime(workspaceConfigPath: string): RuntimeConfigLease {
-    const rendered = renderWorkspaceRuntimeFromSnapshotPath({
-      snapshotPath: workspaceConfigPath,
-      harnessDir: this.cfg.harnessDir,
-      configPath: this.cfg.configPath,
-      dataRoot: this.cfg.dataRoot ?? (() => {
-        throw new Error("registry workspace runtime requires an absolute data root");
-      })(),
-      secretRoots: this.cfg.secretRoots ?? [],
-      semanticRuntime: this.cfg.semanticRuntime ?? DEFAULT_SEMANTIC_RUNTIME,
-      workspaceSecretStore: this.cfg.workspaceSecretStore,
-    });
+  acquireWorkspaceRuntime(
+    workspaceConfigPath: string,
+    effectiveRelationships?: string,
+  ): RuntimeConfigLease {
+    const effectiveRelationshipsPath = effectiveRelationships === undefined
+      ? undefined
+      : this.createRuntimeSnapshot(effectiveRelationships);
+    let rendered: ReturnType<typeof renderWorkspaceRuntimeFromSnapshotPath>;
+    try {
+      rendered = renderWorkspaceRuntimeFromSnapshotPath({
+        snapshotPath: workspaceConfigPath,
+        harnessDir: this.cfg.harnessDir,
+        configPath: this.cfg.configPath,
+        dataRoot: this.cfg.dataRoot ?? (() => {
+          throw new Error("registry workspace runtime requires an absolute data root");
+        })(),
+        secretRoots: this.cfg.secretRoots ?? [],
+        semanticRuntime: this.cfg.semanticRuntime ?? DEFAULT_SEMANTIC_RUNTIME,
+        workspaceSecretStore: this.cfg.workspaceSecretStore,
+        effectiveRelationshipsPath,
+      });
+    } catch (error) {
+      if (effectiveRelationshipsPath) this.cleanupRuntimeSnapshot(effectiveRelationshipsPath);
+      throw error;
+    }
     let path: string;
     try {
       path = this.createRuntimeSnapshot(rendered.renderedConfig);
     } catch (error) {
       rendered.releaseSecrets();
+      if (effectiveRelationshipsPath) this.cleanupRuntimeSnapshot(effectiveRelationshipsPath);
       throw error;
     }
     let released = false;
@@ -241,6 +255,7 @@ export class ThtRunner {
         if (released) return;
         released = true;
         this.cleanupRuntimeSnapshot(path);
+        if (effectiveRelationshipsPath) this.cleanupRuntimeSnapshot(effectiveRelationshipsPath);
         rendered.releaseSecrets();
       },
     };