feat(config): wire launcher scripts and compose to config.json (#2)

- common.sh: load_config() exports MOSAIC_DATA_ROOT/PROVIDER/MODEL; fails closed
- compose.yaml: dataRoot mount and provider/model are required env (:? errors)
- build/hello/verify load config before any mutation; no silent bootstrap
- reset.sh: target resolved from configured dataRoot; all safety checks kept

Verified: compose fails without launcher env; verify/reset fail on missing
config; config-driven hello+verify pass; symlink refusal with sandboxed
config (canary survived); config checksum unchanged across reset+rerun.

Closes #2

scripts/common.sh

@@ -1,11 +1,27 @@
-# Shared helpers for the POC host scripts. Not a documented entry point.
+# Shared helpers for the Mosaic host scripts. Not a documented entry point.
 
-MOSAIC_DEV_DIR="/home/jwoltje/.mosaic-dev"
 POC_ROOT_MARKER=".mosaic-poc-root"
 
-# Ensure the runtime state directory exists and carries this project's
-# ownership marker. The marker is what scripts/reset.sh requires before
-# it will delete anything.
+# Load and validate the Mosaic configuration (config.json), exporting
+# MOSAIC_DATA_ROOT, MOSAIC_PROVIDER, and MOSAIC_MODEL.
+#
+# Fails closed: a missing or invalid configuration aborts the calling
+# script before any container or filesystem mutation. Run paths never
+# auto-bootstrap; use scripts/bootstrap.sh explicitly.
+load_config() {
+    local config_env
+    if ! config_env="$(node scripts/mosaic-config.mjs env)"; then
+        echo "common: configuration load failed" >&2
+        exit 1
+    fi
+    eval "$config_env"
+    export MOSAIC_DATA_ROOT MOSAIC_PROVIDER MOSAIC_MODEL
+    MOSAIC_DEV_DIR="$MOSAIC_DATA_ROOT"
+}
+
+# Ensure the configured runtime data directory exists and carries this
+# project's ownership marker. The marker is what scripts/reset.sh requires
+# before it will delete anything.
 bootstrap_runtime_dir() {
     if [ ! -d "$MOSAIC_DEV_DIR" ]; then
         mkdir -p "$MOSAIC_DEV_DIR"