fix: harden workspace runtime snapshots

backend/src/workspaces/runtime-renderer.ts

@@ -31,10 +31,10 @@ function requireBinding(binding: ResolvedBinding, name: string): string {
 
 function legacyDirectConnection(
   binding: ResolvedBinding,
-  names: { host: string; port: string; user: string; passwordFile: string },
+  names: { host: string; port: string; user: string; passwordFile: string; tlsCaFile: string },
   identity: { database: string; schema: string },
 ): Record<string, unknown> {
-  return {
+  const connection: Record<string, unknown> = {
     host: requireBinding(binding, names.host),
     port: Number(requireBinding(binding, names.port)),
     database: identity.database,
@@ -42,6 +42,9 @@ function legacyDirectConnection(
     user: requireBinding(binding, names.user),
     password_file: requireBinding(binding, names.passwordFile),
   };
+  const tlsCaFile = bindingValue(binding, names.tlsCaFile);
+  if (tlsCaFile !== undefined) connection.ssl_ca_file = tlsCaFile;
+  return connection;
 }
 
 function legacyRestEndpoint(
@@ -93,13 +96,13 @@ export function renderRuntimeConfig(
   const database = dwhDirect
     ? { ...legacyDirectConnection(bindings.dwh, {
       host: name("DWH", "HOST"), port: name("DWH", "PORT"), user: name("DWH", "USER"),
-      passwordFile: name("DWH", "PASSWORD_FILE"),
+      passwordFile: name("DWH", "PASSWORD_FILE"), tlsCaFile: name("DWH", "TLS_CA_FILE"),
     }, dwhIdentity), transport: "direct" }
     : placeholderConnection(dwhIdentity);
   const vectorDb = vectorDirect
     ? legacyDirectConnection(bindings.vector, {
       host: name("VECTOR", "HOST"), port: name("VECTOR", "PORT"), user: name("VECTOR", "USER"),
-      passwordFile: name("VECTOR", "PASSWORD_FILE"),
+      passwordFile: name("VECTOR", "PASSWORD_FILE"), tlsCaFile: name("VECTOR", "TLS_CA_FILE"),
     }, vectorIdentity)
     : placeholderConnection(vectorIdentity);
   const embedding: Record<string, unknown> = {