fix(evidence): validate ownership before all searches

harness/tht/corpus/pipeline.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import re
 import uuid
 from dataclasses import asdict, dataclass
 from pathlib import Path
@@ -92,6 +93,12 @@ class CorpusPipeline:
                 self.workspace_id = "default"
             return
         persisted = manifest.metadata.get("workspace_id")
+        if not isinstance(persisted, str) or re.fullmatch(
+            r"[a-z][a-z0-9_-]{0,63}", persisted
+        ) is None:
+            raise PipelineError(
+                "corpus workspace ownership is missing or invalid; use a new corpus root or explicit rebuild"
+            )
         if self.workspace_id is None and isinstance(persisted, str):
             self.workspace_id = persisted
             return