Builder runtime settings

Model, channel, and runtime policy.

Builder memory settings

Customer-memory policy.

Literal-secret validation and tool-grant isolation are enforced. Proactive memory is shown as coming later and cannot be enabled.