Route explicit media generation/import through the shared production runtime while preserving offline fixture separation. Select Workcell user identity from the observed daemon security profile. The live rootful Colima gate passed with AppArmor and seccomp, host UID mapping, no-new-privileges, read-only root, dropped capabilities, no network, and no Docker socket. The default Docker context was unchanged.
Validation: Release-readiness and clean-checkout checks passed (27 unit tests, 12 environment skips), alongside native validation and real Workcell execution. Synthetic rootless identity tests do not claim live rootless verification.
Live provider scope: ElevenLabs TTS passed in the companion runtime; Sound Effects rejected the saved key as unauthorized, and Free-plan music was blocked locally. No media publication or account upgrade is included.
Merged commit: 09a95d197c266df186adc602f9aa80a4d649d4d7.