Simplify worker runtime config and docs

[fqjony]

Summary

• remove worker-owned auth and deployment layers so provider auth stays external
• route entrypoint and CLI env/config re-apply through the shared runtime config path
• add opt-in redacted runtime JSON output and built-in default config files
• reorganize docs around CLI, config, secrets, services, deployment, and references

Validation

• bash -n lib/env_handler.sh lib/cli/env.sh lib/cli/config.sh lib/cli/service.sh lib/runtime_output.sh bin/entrypoint.sh test/modules/10_config.sh test/modules/20_env.sh
• worker env reload / worker config apply smoke test with temporary config paths
• make test blocked locally because Docker daemon socket is unavailable at /Users/jonyfq/.docker/run/docker.sock