Deployment docs do not say that a local worker inherits the server's environment

## What is missing `internal/bootstrap/server.go:472` builds the local worker runner like this: ```go scheduler.NewLocalRunner(wc.Binary, config.FilterWorkerEnv(os.Environ(), wc.LLM.Managed()), config.EnvKeyBuildmaxRunToken) ``` `config.FilterWorkerEnv` removes the `BUILDMAX_*` variables a worker must not see. **Every other variable in the server's environment reaches the child process** — cloud credentials, proxy settings, anything else the server was started with. That is fine, because `LocalRunner` is a development topology. The Kubernetes path is different by construction: `internal/infra/k8s/job.go:303` builds the Job pod's environment from `config.WorkerNeedsEnv` and nothing else, so the server's environment never reaches it. What is missing is anyone saying so where an operator would read it. `LocalRunner` appears in [`docs/ROADMAP.md`](../docs/ROADMAP.md) and [`docs/design/worker-run-token.md`](../docs/design/worker-run-token.md), and nowhere under `docs/deploy/`. An operator choosing between Compose and Kubernetes cannot see the difference from the deployment documentation. ## What would help A short, factual note in `docs/deploy/` — `overview.md` where the two paths are compared, and/or `compose.md`, which is the deployment that uses this runner. Say what is inherited, what is not, and that the Kubernetes path builds the worker environment from an allow-list instead. The judgement is already made: `docs/ROADMAP.md` step 2 says "That is a development topology, and the deployment documentation should say so." This is writing it down, not deciding it. Keep it to what the code does. Do not imply the Compose path is unsafe — it is a development topology and the documentation should read that way. ## Verify ```bash grep -rn "FilterWorkerEnv" internal/bootstrap/server.go grep -rn "WorkerNeedsEnv" internal/infra/k8s/job.go ./make check docs ``` `./make check docs` needs Node for its Markdown lint; without it, open the pull request and let CI run that half.