fix(ci): isolate deployment smoke client (#1)

docs/deployment/linux.md

@@ -49,9 +49,11 @@ Compose, then point `RENDEZVOUS_SMOKE_HTTP_URL` and
 and production-advertised service ports remain 8080/9050. Sibling-container CI
 runners may also set `RENDEZVOUS_CONFIG_SOURCE` and
 `RENDEZVOUS_SECRET_SOURCE` to host-visible absolute bind-source paths; local
-operators should normally keep the checked-in relative defaults. CI attaches
-its ephemeral job container to the isolated Compose network for smoke traffic;
-it does not widen the default loopback HTTP publication.
+operators should normally keep the checked-in relative defaults. CI starts its
+ephemeral smoke client directly on the isolated Compose network; it does not
+widen the default loopback HTTP publication. It mints the disposable publisher
+credential while the generated key is still owner-private, then makes the key
+read-only for the non-root service container.
 
 `deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
 profile, not an Internet template: TCP is published only on host loopback, the