The controller reads its credentials from files; every other env-file secret says why

ADR 0086. mesh-controller mounts its six own secrets and names them with
_FILE twins, so no credential of its own reaches its environment. The 35
containers that still read a secret through an env-file carry
secrets-in-environment with the reason; converting each where its software
accepts a path is the per-module work of issue 041.

modules/model-usage/module.json

@@ -60,7 +60,8 @@
       },
       "env-file": [
         "/var/lib/model-usage/db.env"
-      ]
+      ],
+      "secrets-in-environment": "the mesh's own runtime reads MESH_STORE_* from the environment; a file twin in the SDK is the per-module work of issue 041"
     }
   ]
 }