fix: harden workspace activation and snapshot retention

backend/test/workspaces-diagnostics.test.ts

@@ -336,7 +336,7 @@ llm_policy:
   }));
 });
 
-test("uses a loopback-only SSH tunnel for the bounded connector probe", async () => {
+test("does not advertise a probe-only SSH tunnel as usable by runtime sessions", async () => {
   const adapters = successfulAdapters();
   const sshBindings: RuntimeBindings = {
     ...bindings,
@@ -360,7 +360,11 @@ test("uses a loopback-only SSH tunnel for the bounded connector probe", async ()
 
   const result = await diagnose(adapters)(workspace, sshBindings, { writeProbe: false });
 
-  expect(result.activatable).toBe(true);
+  expect(result.activatable).toBe(false);
+  expect(result.diagnostics).toContainEqual(expect.objectContaining({
+    level: "error",
+    code: "workspace_not_activatable",
+  }));
   expect(adapters.withSshTunnel).toHaveBeenCalledWith(expect.objectContaining({
     localHost: "127.0.0.1",
     localPort: 0,