Normalize runtime secret transport whitespace

src/user_engine/runtime.py

@@ -69,7 +69,13 @@ def main() -> None:
 
 
 def _required(name: str) -> str:
-    value = os.environ.get(name)
+    # Values sourced from files or `kubectl create secret --from-file` commonly
+    # retain one trailing newline.  Such a value is unusable in HTTP headers
+    # (notably USER_ENGINE_PROXY_SECRET and provisioning bearer tokens), and
+    # comparing it byte-for-byte makes the trusted boundary impossible to
+    # exercise.  Normalize transport whitespace at the runtime boundary; the
+    # domain and adapters still receive an opaque non-empty value.
+    value = os.environ.get(name, "").strip()
     if not value:
         raise RuntimeError(f"{name} is required")
     return value