Centralize runtime config setup

docs/internal/app.md

@@ -31,13 +31,14 @@ root as a local backend, validates exactly that root bundle, and then uses the
 same destination fan-out path as normal runs.
 
 `Validate` and `Inspect` accept either a local path or one configured pipeline
-source. They share source backend construction with run workflows and never open
-destination backends.
+source. Configured-source mode uses the same runtime config and secret setup as
+run workflows, shares source backend construction, and never opens destination
+backends.
 
-`Serve` is the CLI-facing HTTP upload server entrypoint. It loads config,
-loads the configured secrets directory, resolves upload bearer tokens for
-configured `http_upload` sources, creates an `UploadCoordinator`, binds
-`server.http.bind`, and serves the upload API until its context is cancelled.
+`Serve` is the CLI-facing HTTP upload server entrypoint. It uses the app
+runtime setup, resolves upload bearer tokens for configured `http_upload`
+sources, creates an `UploadCoordinator`, binds `server.http.bind`, and serves
+the upload API until its context is cancelled.
 
 ## Run Reports
 
@@ -58,9 +59,11 @@ failures, return before a complete run report is available.
 
 The app runner:
 
-1. loads config from the supplied path or `config.DefaultConfigPath`;
-2. loads configured secret files into a config-owned environment resolver;
-3. builds the app-level backend factory and transform registry;
+1. builds runtime setup by resolving the config path, loading config, loading
+   configured secret files, and projecting secret-conflict warnings;
+2. builds the app-level backend factory from the config-owned environment
+   resolver;
+3. builds the app-level transform registry;
 4. opens each selected pipeline source backend;
 5. discovers validated source bundles from the source root;
 6. selects source bundles for each destination according to path mapping;
@@ -195,6 +198,8 @@ output stream can no longer be trusted.
 
 Run helpers are grouped by responsibility:
 
+- `runtime.go`: runtime config path resolution, config loading, secret loading,
+  environment resolver handoff, and secret-conflict warning projection.
 - `run.go`: `Run`, `RunPipeline`, and shared run orchestration.
 - `run_output.go`: `RunReport`, action/output records, and text/JSON report projection.
 - `run_summary.go`: summary counters.
@@ -205,7 +210,7 @@ Run helpers are grouped by responsibility:
 - `run_coordinator.go`: in-memory run admission, run IDs, status records, and duplicate-run errors.
 - `upload_coordinator.go`: in-memory upload admission, queue reservation, staging handoff, status tracking, queueing, and staged-source execution.
 - `upload_http.go`: HTTP upload authentication, routes, JSON response projection, and HTTP error mapping.
-- `serve.go`: config/secrets loading and HTTP server startup.
+- `serve.go`: HTTP server startup.
 - `backends.go`: app-level backend factory wiring.
 - `transforms.go`: app-level transform registry wiring.
 - `source_select.go`: configured-source selection shared by `validate` and `inspect`.