Mounts ./secrets to /secrets:ro so LINGMA_SESSION_BUNDLE_FILE can point at a host-managed file without the bundle ever being baked into the image or committed to git. secrets/ is git-ignored except for .gitkeep so the directory exists on fresh clones. Made-with: Cursor