feat(deployment): add secure Linux runtime (#17)

docs/security/provisioning.md

@@ -63,8 +63,9 @@ only its public key ID/lifecycle metadata and does not require retired secret
 material to remain available.
 
 Key IDs are non-secret base64url identifiers. Secret references are resolved
-through `ISecretProvider`; production supports `env:<VARIABLE>` references and
-the interface is replaceable by a deployment-specific vault/KMS adapter. The
+through `ISecretProvider`; production supports base64 `env:<VARIABLE>` and raw
+`file:/absolute/path` references to bounded non-symlink files. The interface is
+replaceable by a deployment-specific vault/KMS adapter. The
 committed development profile uses an in-memory random key identified by a
 `development:ephemeral/...` reference. It never writes key material to disk and
 all credentials become invalid when the process exits.
@@ -74,8 +75,10 @@ all credentials become invalid when the process exits.
 `Rendezvous:Provisioning` supplies issuer, audience, clock skew, signing-key
 descriptors, and game policies. A production key reference such as
 `env:RENDEZVOUS_SIGNING_KEY_2026_01` expects that environment variable to hold at
-least 32 random bytes encoded as base64. Missing, malformed, short, inactive, or
-duplicate keys stop startup with a key-ID-only diagnostic. No game-wide secret
+least 32 random bytes encoded as base64. `file:/run/secrets/rendezvous-signing`
+expects the raw bytes in a read-only, absolute, non-symlink file. Missing,
+malformed, short, inactive, or duplicate keys stop startup with a key-ID-only
+diagnostic. No game-wide secret
 belongs in `appsettings`, source control, examples, the Client package, URLs,
 responses, logs, metrics, exceptions, or diagnostic dumps.