fix: nest internal semantic runtime resources

.superpowers/sdd/2026-08-08-internal-qdrant-ollama/task-3-report.md

@@ -90,3 +90,43 @@ Reason: the new typed internal semantic runtime config had to flow from backend
 ## Concerns
 
 - Host validation currently permits both `http` and `https` on the allowed internal hosts. That keeps the configuration flexible, but if the installation contract intended `http` only, that restriction is not enforced here.
+
+## Fix round 1/5
+
+Scope:
+
+- moved schema-v3 internal embeddings under `resources.embeddings`
+- enforced `http`-only internal semantic URLs
+
+RED evidence:
+
+`cd backend && npx vitest run test/workspace-runtime-renderer.test.ts test/config.test.ts`
+
+Observed failures on `bc8afe0`:
+
+- `workspace-runtime-renderer.test.ts`
+  - schema-v3 output omitted `resources.embeddings`
+  - schema-v3 still exposed top-level `embeddings`
+- `config.test.ts`
+  - `https://qdrant:6333` was accepted
+
+GREEN evidence:
+
+`cd backend && npx vitest run test/workspace-runtime-renderer.test.ts test/config.test.ts`
+
+Result:
+
+- 2 test files passed
+- 16 tests passed
+
+Typecheck:
+
+`cd backend && npx tsc --noEmit -p .`
+
+Result:
+
+- passed
+
+Updated concerns:
+
+- none for this round beyond future tightening if exact-port rejection is later requested explicitly.