fix: harden workspace activation and snapshot retention

backend/test/workspace-runtime-renderer.test.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "vitest";
 import { parse } from "yaml";
 import { renderRuntimeConfig, type RuntimeBindings, type RuntimePaths } from "../src/workspaces/runtime-renderer.js";
+import { supportsSessionRuntime } from "../src/workspaces/bindings.js";
 import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
 const workspace = parseWorkspaceYaml(`workspace:
@@ -90,6 +91,18 @@ const directBindings: RuntimeBindings = {
   },
 };
 
+test("runtime support stays fail-closed for either SSH connector", () => {
+  expect(supportsSessionRuntime(directBindings)).toBe(true);
+  expect(supportsSessionRuntime({
+    ...directBindings,
+    dwh: { ...directBindings.dwh, transport: "ssh_tunnel" },
+  })).toBe(false);
+  expect(supportsSessionRuntime({
+    ...directBindings,
+    vector: { ...directBindings.vector, transport: "ssh_tunnel" },
+  })).toBe(false);
+});
+
 test("renders a direct PostgreSQL binding to the legacy harness shape", () => {
   const yaml = renderRuntimeConfig(workspace, directBindings, paths);
   const rendered = parse(yaml);