feat: define workspace diagnostic contracts

backend/src/workspaces/bindings.ts

@@ -63,7 +63,7 @@ function isSafeSecretFile(path: string, secretRoots: readonly string[]): boolean
 }
 
 function requiredSuffixes(
-  role: InstallationRole,
+  role: Exclude<InstallationRole, "VECTOR_WRITER">,
   transport: DwhTransport | VectorTransport,
 ): readonly InstallationSuffix[] {
   if (role === "EMBEDDING") return EMBEDDING_REQUIRED_SUFFIXES;
@@ -76,7 +76,7 @@ function requiredSuffixes(
  */
 export function resolveBinding(
   workspace: CanonicalWorkspace,
-  role: InstallationRole,
+  role: Exclude<InstallationRole, "VECTOR_WRITER">,
   env: NodeJS.ProcessEnv,
   secretRoots: readonly string[],
 ): ResolvedBinding {