fix: gate workspace diagnostic migration

backend/src/workspaces/bindings.ts

@@ -5,9 +5,9 @@ import {
   DWH_TRANSPORTS,
   VECTOR_TRANSPORTS,
   validateCanonicalWorkspace,
-  type CanonicalWorkspace,
   type DwhTransport,
   type VectorTransport,
+  type WorkspaceDescriptor,
 } from "./schema.js";
 
 export interface ResolvedBinding {
@@ -63,10 +63,11 @@ function isSafeSecretFile(path: string, secretRoots: readonly string[]): boolean
 }
 
 function requiredSuffixes(
-  role: Exclude<InstallationRole, "VECTOR_WRITER">,
+  role: InstallationRole,
   transport: DwhTransport | VectorTransport,
 ): readonly InstallationSuffix[] {
   if (role === "EMBEDDING") return EMBEDDING_REQUIRED_SUFFIXES;
+  if (role === "VECTOR_WRITER") return ["API_KEY_FILE"];
   return REQUIRED_SUFFIXES[role][transport] ?? [];
 }
 
@@ -75,8 +76,8 @@ function requiredSuffixes(
  * deliberately left for the harness secret-file loader, so bindings cannot leak credentials.
  */
 export function resolveBinding(
-  workspace: CanonicalWorkspace,
-  role: Exclude<InstallationRole, "VECTOR_WRITER">,
+  workspace: WorkspaceDescriptor,
+  role: InstallationRole,
   env: NodeJS.ProcessEnv,
   secretRoots: readonly string[],
 ): ResolvedBinding {