Wire RUNNER_AUTH_TOKEN through dev/test/main Compose, validate uploads with extension whitelist and content sniffing, add readiness soak script and short PG loop test, and require runner token in prod when URL is set. Co-authored-by: Cursor <cursoragent@cursor.com>