fix: preserve deterministic runtime secret leases

backend/src/workspace-maintenance.ts

@@ -7,6 +7,7 @@ import { loadConfig } from "./config.js";
 import { ThtRunner } from "./tht/tht-runner.js";
 import { WorkspaceRegistry } from "./workspaces/registry.js";
 import { publishDeterministicRuntimeConfigLease, renderActiveWorkspaceRuntime } from "./workspaces/runtime-config-lease.js";
+import { WorkspaceSecretStore } from "./workspaces/secret-store.js";
 import { WorkspacePreprocessingService, type WorkspaceOperationResult } from "./workspaces/preprocessing-service.js";
 import type { SessionInventoryRow } from "./workspaces/preprocessing-state.js";
 
@@ -213,6 +214,11 @@ async function readSessionInventory(dataRoot: string, workspaceId: string): Prom
 function createProductionService(): WorkspacePreprocessingService {
   const config = loadConfig(process.env);
   const registry = new WorkspaceRegistry(config.workspaceRegistry);
+  const workspaceSecretStore = new WorkspaceSecretStore({
+    root: config.workspaceSecretStoreRoot,
+    runtimeRoot: config.workspaceSecretRuntimeRoot,
+    installationId: config.workspaceRegistry.installationId,
+  });
   const runner = new ThtRunner({
     thtBin: config.thtBin,
     harnessDir: config.harnessDir,
@@ -222,6 +228,7 @@ function createProductionService(): WorkspacePreprocessingService {
     secretRoots: config.workspaceRegistry.secretRoots,
     secretsFile: config.secretsFile,
     secretFiles: config.secretFiles,
+    workspaceSecretStore,
     semanticRuntime: {
       internalQdrantUrl: config.internalQdrantUrl,
       internalEmbeddingUrl: config.internalEmbeddingUrl,
@@ -263,6 +270,7 @@ function createProductionService(): WorkspacePreprocessingService {
           internalEmbeddingModel: config.internalEmbeddingModel,
           internalEmbeddingDimensions: config.internalEmbeddingDimensions,
         },
+        workspaceSecretStore,
       });
       return {
         workspace: active.workspace,