feat: bind evidence credentials through local files

harness/tests/test_config_resources.py

@@ -384,3 +384,20 @@ evidence:
     legacy_source = build_evidence_sources(load_config(legacy))[0]
     assert isinstance(legacy_source, FilesystemEvidenceSource)
     assert legacy_source.root == (tmp_path / "curated").resolve()
+
+
+
+def test_safe_validation_formatter_keeps_location_and_type_without_rejected_input(tmp_path):
+    workspace = tmp_path / "workspace.yaml"
+    workspace.write_text("""
+dwh:
+  type: postgres_direct
+  connection: {database: analytics, schema: public, user: reader}
+""")
+
+    with pytest.raises(ConfigError) as caught:
+        load_config(workspace)
+
+    message = str(caught.value)
+    assert "dwh.postgres_direct.connection.password" in message
+    assert "missing" in message