DL-080

Config injection is a Runner-local read-only bind mount of the parent config dir at /run/compass/agent-config (agent reads through current/); env-vars ride RIG-1327’s secret surface exclusively; MVP forbids credentials in MCP configs (RIG-1576 tracks the post-MVP credentialed path)

Status: Active (Matt, 2026-07-30)