feat: complete Epic 1 production foundation

scripts/check-runtime-config.py

@@ -209,6 +209,14 @@ def validate_runtime_reference(
         raise ContractError(f"divergent Compose inline default: {name}")
 
 
+def compose_optional(specification: dict[str, object]) -> bool:
+    compatibility = specification.get("compatibility")
+    return (
+        isinstance(compatibility, str)
+        and "deprecated startup-bootstrap password" in compatibility
+    )
+
+
 def validate(root: Path) -> None:
     effective, specifications, deployment = load_contract(root)
     declared_values: dict[str, set[str]] = {name: set() for name in effective}
@@ -235,6 +243,7 @@ def validate(root: Path) -> None:
             name
             for name in effective
             if specifications[name]["process"] in {"shared", "admin_api"}
+            and not compose_optional(specifications[name])
         }
         required_mcp = {
             name