Mounts ./secrets to /secrets:ro so LINGMA_SESSION_BUNDLE_FILE can point
at a host-managed file without the bundle ever being baked into the
image or committed to git. secrets/ is git-ignored except for .gitkeep
so the directory exists on fresh clones.
Made-with: Cursor
