feat: render private semantic service endpoints

backend/src/tht/tht-runner.ts

@@ -9,7 +9,12 @@ import { parseAllDocuments } from "yaml";
 import { clearPrincipalEnvironment, principalEnvironment, type PrincipalContext } from "../auth/principal.js";
 import { secretValue, type SecretBundleConfig } from "../config/secret-bundle.js";
 import { resolveRuntimeBindings } from "../workspaces/bindings.js";
-import { renderRuntimeConfig, type RuntimeInstallationOverlay, type RuntimePaths } from "../workspaces/runtime-renderer.js";
+import {
+  renderRuntimeConfig,
+  type RuntimeInstallationOverlay,
+  type RuntimePaths,
+  type SemanticRuntimeConfig,
+} from "../workspaces/runtime-renderer.js";
 import { parseWorkspaceYaml } from "../workspaces/schema.js";
 
 export interface ThtConfig extends SecretBundleConfig {
@@ -19,6 +24,7 @@ export interface ThtConfig extends SecretBundleConfig {
   dataRoot?: string;
   runtimeSnapshotRoot?: string;
   secretRoots?: readonly string[];
+  semanticRuntime: SemanticRuntimeConfig;
 }
 
 export interface RuntimeConfigLease {
@@ -190,6 +196,7 @@ export class ThtRunner {
       this.runtimePaths(canonical.workspaceId),
       canonical,
       this.installationOverlay(),
+      this.cfg.semanticRuntime,
     );
     const path = this.createRuntimeSnapshot(config);
     let released = false;