Environment configuration: Workflow and infrastructure
Defines a typed configuration contract, explicit precedence, secret references, startup validation, immutable deployment snapshots, and safe rotation so environments differ intentionally rather than through hidden state.