fix(preprocess): restrict DWH root claims to writers

harness/tests/test_search_pack.py

@@ -5,6 +5,8 @@ from types import SimpleNamespace
 from typer.testing import CliRunner
 
 from tht.cli import app
+from tht.config import load_config
+from tht.jobs.dwh_pipeline import DwhPreprocessPipeline, config_dwh_binding
 from tht.mschema.models import ColumnPhysical, PhysicalSchema, TablePhysical
 from tht.vectorstore.embeddings import EmbeddingsError
 
@@ -43,11 +45,11 @@ class _FakeSearcher:
 
 
 def _workspace(tmp_path, with_session=None):
-    PhysicalSchema(
+    physical = PhysicalSchema(
         database="d", schema="s", introspected_at=datetime(2026, 1, 1),
         tables={"fact_ablazione": TablePhysical(
             comment="Ablazioni", columns={"cod_paz": ColumnPhysical(type="bigint")})},
-    ).to_yaml(tmp_path / "artifacts" / "mschema" / "physical.yaml")
+    )
     cfg = tmp_path / "workspace.yaml"
     cfg.write_text(
         "database: {database: d, schema: s, user: u, password: p, transport: direct}\n"
@@ -56,6 +58,18 @@ def _workspace(tmp_path, with_session=None):
         f"paths: {{artifacts: {tmp_path/'artifacts'}, indexes: {tmp_path/'i'}, "
         f"sessions: {tmp_path/'sessions'}}}\n"
     )
+    binding = config_dwh_binding(load_config(cfg))
+    DwhPreprocessPipeline(
+        workspace_id=binding["workspace_id"], workspace_root=tmp_path,
+        config_fingerprint=binding["config_fingerprint"],
+        input_fingerprint=binding["input_fingerprint"],
+        introspect=lambda output: physical.to_yaml(output),
+        build_lsh=lambda _physical, output: [
+            (output / name).write_text("index")
+            for name in ("s_lsh.pkl", "s_minhashes.pkl", "s_meta.json")
+        ],
+        lsh_filenames=("s_lsh.pkl", "s_minhashes.pkl", "s_meta.json"),
+    ).run()
     if with_session:
         sdir = tmp_path / "sessions" / with_session
         sdir.mkdir(parents=True)