Shared bits of the two run paths (single-app Runner + multi-app Multi): the child env, the display URL, and first-run CA trust. Both expect a @config.
@config