feat: add durable addressed registry publication

harness/tht/cli/vector_cmd.py

@@ -24,6 +24,12 @@ from tht.vectorstore.store import SyncStats, content_hash
 vector_app = typer.Typer(help="Indice semantico Qdrant (derivato, rigenerabile)")
 logger = logging.getLogger(__name__)
 
+def _require_writer_capability() -> None:
+    import os
+    if os.environ.get("THOTH_WORKSPACE_CAPABILITY_REQUIRED") == "1":
+        from tht.workspace_writer_lock import require_workspace_writer_capability
+        require_workspace_writer_capability()
+
 
 def make_embedder(embeddings_cfg):
     """Factory del client embeddings (monkeypatchabile nei test)."""
@@ -64,6 +70,7 @@ def open_searcher(cfg):
 
 
 def sync_canonical_records(collection, records, *, store, embedder):
+    _require_writer_capability()
     kinds = sorted({record.kind for record in records})
     existing = store.existing_hashes(collection, kinds)
     pending = []