Non-secret config now lives in Infisical alongside the secrets, so containers carry envFrom only and no loose env entries.