feat(config): wire launcher scripts and compose to config.json (#2)

- common.sh: load_config() exports MOSAIC_DATA_ROOT/PROVIDER/MODEL; fails closed
- compose.yaml: dataRoot mount and provider/model are required env (:? errors)
- build/hello/verify load config before any mutation; no silent bootstrap
- reset.sh: target resolved from configured dataRoot; all safety checks kept

Verified: compose fails without launcher env; verify/reset fail on missing
config; config-driven hello+verify pass; symlink refusal with sandboxed
config (canary survived); config checksum unchanged across reset+rerun.

Closes #2

scripts/reset.sh

@@ -7,9 +7,15 @@
 #      created by this project.
 # Any failed check aborts with nothing deleted.
 set -euo pipefail
+cd "$(dirname "$0")/.."
+# shellcheck source=common.sh
+source scripts/common.sh
 
-TARGET="/home/jwoltje/.mosaic-dev"
-MARKER=".mosaic-poc-root"
+# Reset operates on the CONFIGURED data root. Configuration itself is
+# never a reset target; a missing/invalid configuration aborts here.
+load_config
+TARGET="$MOSAIC_DATA_ROOT"
+MARKER="$POC_ROOT_MARKER"
 
 fail() {
     echo "reset: refusing to delete: $*" >&2