feat(config): fail-closed manifest-driven injection + runtime write-back delivery (D6)

src/handlers/config/config.go

@@ -148,6 +148,13 @@ func (h *Handler) Value(w http.ResponseWriter, r *http.Request) {
 		}
 		writeJSON(w, http.StatusOK, view)
 
+		// Runtime write-back (D6): best-effort delivery to the running service's
+		// POST /config endpoint. The goroutine is fire-and-forget; values always
+		// also take effect at next start via injectConfigSecrets (M1).
+		go libcontainers.DeliverConfigValues(r.Context(), container.ServiceName, []libcontainers.ConfigDelivery{
+			{Field: field, Key: spec.Key, Type: spec.Type, Value: action.Value},
+		})
+
 	default:
 		writeError(w, http.StatusMethodNotAllowed, "ERR_METHOD_NOT_ALLOWED")
 	}