test: expect canonical secret binding paths

backend/test/workspaces-diagnostics.test.ts

@@ -1,6 +1,6 @@
 import { expect, test, vi } from "vitest";
 import { EventEmitter } from "node:events";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -621,10 +621,13 @@ test("passes the resolver's distinct vector-writer binding to the diagnoser", as
 
     await diagnose(adapters)(writerWorkspace, resolved, { writeProbe: true });
 
+    const canonicalWriterKey = await realpath(writerKey);
     expect(resolved.vectorWriter.values).toEqual({
-      THT_WS_PSD_CLINICAL_VECTOR_WRITER_API_KEY_FILE: writerKey,
+      THT_WS_PSD_CLINICAL_VECTOR_WRITER_API_KEY_FILE: canonicalWriterKey,
     });
-    expect(adapters.writeDiagnosticRecord).toHaveBeenCalledWith(expect.objectContaining({ credentialFile: writerKey }));
+    expect(adapters.writeDiagnosticRecord).toHaveBeenCalledWith(
+      expect.objectContaining({ credentialFile: canonicalWriterKey }),
+    );
   } finally {
     await rm(directory, { recursive: true, force: true });
   }