DL-501

FetchAgentConfig requires container_name, authorizes like FetchSecrets, and reads all layers in one statement.

Status: Active (Matt, 2026-10-13)

Record: ../../agent-config-overlays.md#decisions