feat(config): wire launcher scripts and compose to config.json (#2)

- common.sh: load_config() exports MOSAIC_DATA_ROOT/PROVIDER/MODEL; fails closed
- compose.yaml: dataRoot mount and provider/model are required env (:? errors)
- build/hello/verify load config before any mutation; no silent bootstrap
- reset.sh: target resolved from configured dataRoot; all safety checks kept

Verified: compose fails without launcher env; verify/reset fail on missing
config; config-driven hello+verify pass; symlink refusal with sandboxed
config (canary survived); config checksum unchanged across reset+rerun.

Closes #2

scripts/hello.sh

@@ -10,6 +10,8 @@ cd "$(dirname "$0")/.."
 # shellcheck source=common.sh
 source scripts/common.sh
 
+load_config
+
 bootstrap_runtime_dir
 
 # -T: no pseudo-TTY, so stdout is clean model output.