feat: add durable addressed registry publication

harness/tht/cli/preprocess_cmd.py

@@ -20,6 +20,13 @@ from tht.vectorstore.embeddings import EmbeddingsError
 preprocess_app = typer.Typer(help="Materialize versioned preprocessing artifacts")
 logger = logging.getLogger(__name__)
 
+def _require_writer_capability() -> None:
+    """Mutating children opt into the backend-owned fd capability contract."""
+    import os
+    if os.environ.get("THOTH_WORKSPACE_CAPABILITY_REQUIRED") == "1":
+        from tht.workspace_writer_lock import require_workspace_writer_capability
+        require_workspace_writer_capability()
+
 _PREPROCESS_EXPECTED_ERRORS = (
     OSError, RuntimeError, ValueError, TypeError, KeyError,
     EvidenceSourceError, VectorStoreError, EmbeddingsError,
@@ -29,6 +36,7 @@ _PREPROCESS_EXPECTED_ERRORS = (
 def run_dwh_from_config(
     config: Path, *, steps: tuple[str, ...], resume: str | None = None,
 ):
+    _require_writer_capability()
     from tht.cli.lsh_cmd import build_lsh_artifacts
     from tht.cli.schema_cmd import _load_config_or_exit, refresh_catalog
     from tht.jobs.dwh_pipeline import (
@@ -74,6 +82,7 @@ def _parse_dwh_steps(value: str) -> tuple[str, ...]:
 
 
 def run_from_config(config: Path, *, dry_run: bool = False, resume: str | None = None):
+    _require_writer_capability()
     from tht.adapters.factory import build_evidence_sources, build_vector_store
     from tht.cli.vector_cmd import make_embedder
     from tht.corpus.chunk import ChunkPolicy