fix: remove credential env overrides

[heeyeon01]

Summary

• What changed:
  • Removed the six env var overrides that correspond to credentials managed by /rune:configure. reload_pipelines now correctly picks up updated credentials from config.json without requiring a session restart.
  • Updated load_config() docstring to reflect that vault/envector credentials are loaded exclusively from config.json.
• Why:

  • Context

    • /rune:configure collects Vault and enVector credentials and writes them to
      ~/.rune/config.json.
    • The MCP server exposes a reload_pipelines tool that re-reads config.json at runtime, allowing credential updates to take effect without restarting the session.

  • Problem

    • load_config() applied environment variable overrides for RUNEVAULT_ENDPOINT,
      RUNEVAULT_TOKEN, VAULT_CA_CERT, VAULT_TLS_DISABLE, ENVECTOR_ENDPOINT, and ENVECTOR_API_KEY after reading the config file.
    • they would override the newly written config values on every reload_pipelines call, causing reconfiguration to have no effect and producing a misleading "Vault key fetch failed" error that suggested a permissions problem.
• Scope:
  • agents/common/config.py
  • agents/tests/test_config.py

Validation

• Tests run (or explain why not):
  • agents/tests/test_config.py — Added TestCredentialOverrideConfig class
    Added 12 parametrized test cases covering all 6 removed env vars
    • test_credential_not_overridden_by_env — env var present but config.json value wins
    • test_reload_picks_up_reconfigured_credential — second load_config() call (simulating
      reload_pipelines) reflects updated file value

Cross-Agent Invariants

• scripts/bootstrap-mcp.sh remains the single source of truth for runtime prep (venv/deps/self-heal)
• No agent-specific script duplicates bootstrap/setup logic
• Agent-specific scripts remain thin adapters (registration/wiring only)
• Codex-only commands (codex mcp ...) are clearly separated from cross-agent/common instructions
• Claude/Gemini/OpenAI instructions do not include Codex-only commands
• SKILL.md, commands/rune/*.toml, and AGENT_INTEGRATION.md stay consistent on boundaries

Notes for Reviewers

• Risk areas:
• Backward compatibility impact:
• Follow-up work (if any):

[jh-lee-cryptolab]

LGTM