chore(security): keep local stack secrets out of process command lines

[BjornMelin]

Problem

A local runtime diagnostic showed that development stack bootstrap material can appear in process command arguments. Process listings and diagnostic tooling may therefore expose local credentials or certificate material.

Scope

• Move secret and private-key payloads out of shell command arguments.
• Prefer mounted files, protected environment files, Docker secrets, or equivalent stdin-based provisioning.
• Keep generated local-only material out of logs and diagnostic output.
• Add a regression or documented verification that process listings contain no secret payloads.
• Review local developer bootstrap paths only; do not include any credential values in this issue.

Acceptance

• Local stack starts normally.
• Process command lines contain references to protected inputs, not their contents.
• Existing test and local validation workflows remain green.

This issue intentionally contains no secret values and requires a separate trusted security review if credential rotation is deemed necessary.