fix: stabilize runtime workspace identity

harness/tht/config.py

@@ -165,6 +165,19 @@ class PathsConfig(BaseModel):
 class RuntimeIdentityConfig(BaseModel):
     workspace_id: str = Field(pattern=r"^[a-z][a-z0-9-]{2,62}$")
     workspace_revision: str = Field(pattern=r"^[0-9a-f]{40}$")
+    source_identity: str | None = Field(
+        default=None,
+        pattern=r"^workspace://[a-z][a-z0-9-]{2,62}$",
+    )
+
+    @model_validator(mode="after")
+    def source_matches_workspace(self):
+        expected = f"workspace://{self.workspace_id}"
+        if self.source_identity is None:
+            self.source_identity = expected
+        elif self.source_identity != expected:
+            raise ValueError("source_identity must match workspace_id")
+        return self
 
 
 class WorkspaceRoots(PathsConfig):
@@ -430,7 +443,11 @@ def load_config(path: Path) -> Config:
         if cfg.runtime_identity is not None
         else None
     )
-    cfg._config_source = path.resolve().as_posix()
+    cfg._config_source = (
+        cfg.runtime_identity.source_identity
+        if cfg.runtime_identity is not None
+        else path.resolve().as_posix()
+    )
     return cfg