- Launcher: check gateway add error, json.Unmarshal error, copyFile close
- Launcher: mTLS dir 0755→0700, copyFile uses 0600 permissions
- Add envOr() helper, apply to OPENSHELL_MODEL, CLOUD_ML_REGION,
  SANDBOX_IMAGE, GATEWAY_NAME
- Triage todo-improve.md against design.md rearchitect plan

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Flatten CheckInput file case (4 levels → early returns), delete
  pickKeys/pickKeysExcept/formatMeta (~30 lines)
- Remove ConfigFile.ChartVersion alias, use Upstream.ChartVersion directly
- Shared sccPrivilegedSAs and secretNames slices (deploy ↔ teardown)
- Simplify extractYAMLID with strings.CutPrefix
- Fix test: /tmp/test-create-args → t.TempDir()
- Inline deployLocal podmanPath variable
- Change --grace-period=0 to --grace-period=30 for pod cleanup
- Remove PII (email) and sk-ant- prefix from default.toml
- Update stale bash script references in default.toml comments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Captures project goals, the gateway-as-central-concept architecture,
three domains (infrastructure, providers, sandbox), proposed command
interface, config organization, and two-level provider health checking.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- design.md → docs/design.md
- release_plan.md → docs/release-plan.md
- proto_migration.md → docs/proto-migration.md (new to repo)
- profile.md → docs/profile-concepts.md (new to repo)
- Fix cross-references between docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Fix staging dir: os.MkdirTemp parent with "openshell" subdirectory so
  upload creates /sandbox/.config/openshell/ (startup.sh expects this path)
- Fix test-flow.sh: bare teardown → explicit --sandboxes --providers --k8s
  (bare teardown now requires flags per safety change)
- Restore sk-ant- API key prefix and JIRA_USERNAME in default.toml
  (needed by sandbox runtime)

All 19/19 podman integration tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Provider-specific env vars (JIRA_URL, JIRA_USERNAME) are validated in
providers.toml but hardcoded in profiles/default.toml. Two-phase fix:
short-term expand $VAR references in BuildSandboxEnv, long-term flow
provider config values automatically from registration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Provider env vars marked with sandbox = true in providers.toml are
automatically resolved from the local environment and injected into
sandbox.env when the provider is enabled in the profile.

- Add Input.Sandbox field and ProviderEnvVars() in preflight package
- newLocal merges provider env vars into profile env before staging
- Mark JIRA_URL and JIRA_USERNAME as sandbox = true in providers.toml
- Remove hardcoded JIRA_URL/JIRA_USERNAME from profiles/default.toml

Profile [env] now only contains sandbox-level settings. Provider
config flows automatically from the environment via providers.toml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>