fix: fail closed v3 legacy semantic fallbacks

backend/test/workspaces-contracts.test.ts

@@ -39,6 +39,29 @@ llm_policy:
     - zai/glm-5.2
     - openai/gpt-5
 `);
+const workspaceV3 = parseWorkspaceYaml(`workspace:
+  schema_version: 3
+  id: psd-clinical
+  name: Policlinico San Donato
+  language: it
+dwh:
+  engine: postgres
+  database: postgres
+  schema: datawarehouse
+  supported_transports: [postgres_direct, rest_api]
+semantic_index:
+  vector_store:
+    engine: qdrant
+    collection: psd-clinical
+    dimensions: 1024
+    distance: cosine
+  embedding:
+    provider: ollama_internal
+    model: qwen3-embedding:0.6b
+    dimensions: 1024
+llm_policy:
+  allowed: [zai/glm-5.2]
+`);
 
 test("generates stable FILE-based secret requirements from an immutable ID", () => {
   const contract = buildInstallationContract(validWorkspace);
@@ -278,3 +301,13 @@ test("validates public contract and documentation inputs at runtime", () => {
   expect(() => buildInstallationContract(unsafeWorkspace)).toThrow(/id/i);
   expect(() => renderWorkspaceDocs(unsafeWorkspace)).toThrow(/id/i);
 });
+
+test("v3 installation contract omits external vector and embedding bindings", () => {
+  const contract = buildInstallationContract(workspaceV3);
+  const names = contract.variables.map((variable) => variable.name);
+
+  expect(names).toContain("THT_WS_PSD_CLINICAL_DWH_TRANSPORT");
+  expect(names.some((name) => name.includes("_VECTOR_"))).toBe(false);
+  expect(names.some((name) => name.includes("_EMBEDDING_"))).toBe(false);
+  expect(renderWorkspaceDocs(workspaceV3).markdown).not.toContain("Embedding service");
+});