fix(ops-controller): inject decrypted runtime secrets into compose subprocesses

[AlienWalker1995]

Problem

The ops-controller recreates services via its own docker-compose subprocess (dashboard "recreate", POST /compose/*, /services/*/recreate). Those subprocesses only ever saw the auto-loaded .env — never ~/.ai-toolkit/runtime/.env. So any secret-dependent service ops-controller recreated came up with its secrets unset and crash-looped:

[main.go:67] invalid configuration:
  cookie_secret must be 16, 24, or 32 bytes ... but is 11 bytes

This is the root cause behind the 2026-06-26 oauth2-proxy outage (and the bandaids that followed: placeholder secrets in .env, empty stub files, compose-path rewrites).

Fix (least privilege)

• Mount the already-decrypted runtime/.env read-only into ops-controller (/run/runtime.env) and inject it into the compose subprocess env via a shared _compose_env() helper (which also de-duplicates 3 inline env constructions). docker-compose interpolates ${VAR} from the process env, so recreated secret services now get real values.
• ops-controller gets the decrypted env only — never the age key. Decryption stays a host-only operation (make decrypt-secrets). A compromised ops-controller (already docker-socket-privileged) leaks current secrets but cannot decrypt .sops history or re-derive the key.
• caddy/oauth2-proxy/searxng added to ALLOWED_SERVICES — now safe to recreate. (The self-heal watchdog already covers them via its exclude-list model; the "hermes-only" comment was stale and is corrected.)

Changes

• ops-controller/main.py — _load_runtime_env() + _compose_env(); used in _recreate_service, _run_compose, and the /services/*/recreate endpoint. ALLOWED_SERVICES += caddy/oauth2-proxy/searxng.
• docker-compose.yml — read-only runtime/.env mount + RUNTIME_ENV_FILE; corrected watchdog comment.
• docs/runbooks/secrets.md — new "How services receive secrets at runtime" section (two---env-file model, ops-controller injection, local-only boundary). README + secrets/README.md updated to match.
• tests/test_ops_controller_compose_env.py — parsing, missing-file/dir degradation, runtime-overrides-process-env, extra-overrides-all (fabricated values only).

No secret values are committed — only path references and architecture.

Validation

• End-to-end: docker exec ops-controller → POST /compose/up {"service":"oauth2-proxy"} (the previously-broken path) → oauth2-proxy comes up healthy in ~31s, no cookie_secret error. Verified the 32-byte cookie secret is read inside ops-controller.
• 36 ops-controller tests pass (5 new + existing audit/auth suites); ruff clean.
• Full stack healthy after the change.

🤖 Generated with Claude Code