fixture host config, host config path and private HOME config are hidden
fixture host config, host config path and private HOME config are hidden
run-task container source check: exactly dataRoot and read-only PI_AUTH_FILE; no host ~/.config mount
Scope: no live config read; dataRoot and PI_AUTH_FILE overrides must not expose the proof path. No Docker runtime test claimed.