feat: complete catalog-driven preprocessing

backend/test/workspaces-bindings.test.ts

@@ -7,9 +7,9 @@ import { afterEach, expect, test } from "vitest";
 import {
   resolveBinding, resolveEvidenceBinding, resolveRuntimeBindings, supportsSessionRuntime,
 } from "../src/workspaces/bindings.js";
-import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
+import { parseRuntimeWorkspaceYaml } from "../src/workspaces/schema.js";
 
-const workspaceV4 = parseWorkspaceYaml(`workspace:
+const workspaceV4 = parseRuntimeWorkspaceYaml(`workspace:
   schema_version: 4
   id: psd-clinical
   name: Policlinico San Donato
@@ -63,7 +63,7 @@ test("requires workspace-v4 REST credentials unless the DWH diagnostic declares
     THT_WS_PSD_CLINICAL_DWH_BASE_URL: "https://dwh.example.test",
   }, []).missing).toContain("THT_WS_PSD_CLINICAL_DWH_API_KEY_FILE");
 
-  const noAuth = parseWorkspaceYaml(`workspace:
+  const noAuth = parseRuntimeWorkspaceYaml(`workspace:
   schema_version: 4
   id: psd-clinical
   name: No auth
@@ -89,7 +89,7 @@ diagnostics:
 test("rejects unsupported transports and secret paths outside configured roots", () => {
   const outside = secretPath("outside-password");
   const allowed = secretPath("allowed-password");
-  const directOnly = parseWorkspaceYaml(`workspace:
+  const directOnly = parseRuntimeWorkspaceYaml(`workspace:
   schema_version: 4
   id: psd-clinical
   name: Direct only
@@ -130,7 +130,7 @@ test("runtime bindings contain only DWH and Evidence roles", () => {
 });
 
 function withEvidence(source: Record<string, unknown>) {
-  return parseWorkspaceYaml(`workspace:
+  return parseRuntimeWorkspaceYaml(`workspace:
   schema_version: 4
   id: psd-clinical
   name: Policlinico San Donato