fix: fail closed v3 legacy semantic fallbacks

backend/test/workspace-runtime-renderer.test.ts

@@ -30,6 +30,29 @@ semantic_index:
 llm_policy:
   allowed: [zai/glm-5.2]
 `);
+const workspaceV3 = parseWorkspaceYaml(`workspace:
+  schema_version: 3
+  id: psd-clinical
+  name: Policlinico San Donato
+  language: it
+dwh:
+  engine: postgres
+  database: postgres
+  schema: datawarehouse
+  supported_transports: [postgres_direct, rest_api]
+semantic_index:
+  vector_store:
+    engine: qdrant
+    collection: psd-clinical
+    dimensions: 1024
+    distance: cosine
+  embedding:
+    provider: ollama_internal
+    model: qwen3-embedding:0.6b
+    dimensions: 1024
+llm_policy:
+  allowed: [zai/glm-5.2]
+`);
 const paths: RuntimePaths = {
   sessions: "/data/workspaces/psd-clinical/sessions",
   artifacts: "/data/workspaces/psd-clinical/artifacts",
@@ -149,6 +172,12 @@ test("refuses to render a v1 descriptor until an explicit migration creates v2",
   expect(() => renderRuntimeConfig(legacyWorkspace, directBindings, paths)).toThrow(/migrat/i);
 });
 
+test("fails closed for v3 runtime rendering and session support", () => {
+  expect(supportsSessionRuntime(directBindings)).toBe(true);
+  expect(() => renderRuntimeConfig(workspaceV3, directBindings, paths))
+    .toThrow(/unsupported|schema version 3|qdrant|ollama_internal/i);
+});
+
 test("omits direct TLS fields when binding validation did not retain a file path", () => {
   const dwhValues = { ...directBindings.dwh.values };
   const vectorValues = { ...directBindings.vector.values };