fix: harden workspace registry refresh and snapshots

backend/test/workspaces-git-repository.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, expect, test } from "vitest";
-import { GitWorkspaceRepository } from "../src/workspaces/git-repository.js";
+import { GitWorkspaceRepository, WorkspaceRepositoryLock } from "../src/workspaces/git-repository.js";
 import type { WorkspaceRegistryConfig } from "../src/workspaces/types.js";
 
 const validYaml = `workspace:
@@ -105,3 +105,35 @@ test("redacts failed Git checkout details behind a stable error code", async ()
   });
   expect((error as Error).message).not.toContain(remote);
 });
+
+test("maps registry-layout failures to a stable redacted error", async () => {
+  const root = mkdtempSync(join(tmpdir(), "thoth-workspace-git-layout-"));
+  temporaryRoots.push(root);
+  const file = join(root, "not-a-directory");
+  writeFileSync(file, "occupied");
+  const repository = new GitWorkspaceRepository(config(file, join(root, "remote.git")));
+
+  const error = await repository.bootstrap().catch((error: unknown) => error);
+
+  expect(error).toMatchObject({
+    code: "git_unavailable",
+    message: "Workspace registry storage is unavailable",
+  });
+  expect((error as Error).message).not.toContain(file);
+});
+
+test("maps lock filesystem failures to a stable redacted error", async () => {
+  const root = mkdtempSync(join(tmpdir(), "thoth-workspace-git-lock-"));
+  temporaryRoots.push(root);
+  const file = join(root, "not-a-directory");
+  writeFileSync(file, "occupied");
+  const lock = new WorkspaceRepositoryLock(file);
+
+  const error = await lock.run(async () => undefined).catch((error: unknown) => error);
+
+  expect(error).toMatchObject({
+    code: "git_unavailable",
+    message: "Workspace registry lock is unavailable",
+  });
+  expect((error as Error).message).not.toContain(file);
+});