fix: gate workspace diagnostic migration

backend/test/workspace-runtime-renderer.test.ts

@@ -4,7 +4,7 @@ import { renderRuntimeConfig, type RuntimeBindings, type RuntimePaths } from "..
 import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
 const workspace = parseWorkspaceYaml(`workspace:
-  schema_version: 1
+  schema_version: 2
   id: psd-clinical
   name: Policlinico San Donato
   language: it
@@ -34,6 +34,30 @@ const paths: RuntimePaths = {
   artifacts: "/data/workspaces/psd-clinical/artifacts",
   indexes: "/data/workspaces/psd-clinical/indexes",
 };
+const legacyWorkspace = parseWorkspaceYaml(`workspace:
+  schema_version: 1
+  id: psd-clinical
+  name: Policlinico San Donato
+  language: it
+dwh:
+  engine: postgres
+  database: postgres
+  schema: datawarehouse
+  supported_transports: [postgres_direct]
+semantic_index:
+  vector_store:
+    engine: pgvector
+    collection: clinical_documents
+    dimensions: 768
+    distance: cosine
+    supported_transports: [pgvector_direct]
+  embedding:
+    provider: ollama_compatible
+    model: nomic-embed-text-v2-moe
+    dimensions: 768
+llm_policy:
+  allowed: [zai/glm-5.2]
+`);
 
 const directBindings: RuntimeBindings = {
   dwh: {
@@ -99,6 +123,10 @@ test("renders a direct PostgreSQL binding to the legacy harness shape", () => {
   expect(yaml).toContain("schema: datawarehouse");
 });
 
+test("refuses to render a v1 descriptor until an explicit migration creates v2", () => {
+  expect(() => renderRuntimeConfig(legacyWorkspace, directBindings, paths)).toThrow(/migrat/i);
+});
+
 test("omits direct TLS fields when binding validation did not retain a file path", () => {
   const dwhValues = { ...directBindings.dwh.values };
   const vectorValues = { ...directBindings.vector.values };