Public dry run dryrun-a43e907efd9d

Source commit: a43e907efd9d1561c23fe73499478e881f868355

Public tree identity: sha256:453dea30195485dd8939f575a69b39f4bb7acd84c4df23f8aa29b55d044f2673

docs/environments.md

@@ -0,0 +1,34 @@
+# Environments
+
+Declare environments in the bundle under:
+
+~~~text
+envs/<name>/Containerfile
+envs/<name>/Dockerfile
+~~~
+
+Reference one by logical name:
+
+~~~rust
+use clusterflux::env;
+
+let linux = env!("linux");
+~~~
+
+Bundle inspection reports every discovered environment and its digest:
+
+~~~bash
+clusterflux bundle inspect --project .
+~~~
+
+The bundle definition is authoritative for every spawn. The coordinator passes
+the declared environment identity and digest in the TaskSpec, and the node
+resolves that exact definition. A same-named local recipe with different bytes
+is rejected rather than substituted.
+
+On Linux, container-backed environments use rootless Podman. Clusterflux does
+not enable privileged containers by default.
+
+A task may use a bind-mounted local checkout for speed. That source path is
+non-hermetic. Choose a source snapshot when you need a reproducible input
+identity independent of the current working tree.