Token bake summary

Tag: v0.2.3-live-token
Credential verification: length=32
Dockerfile has ENV EXTERNAL_SERVICE_TOKEN; Python parsed it and verified equality with the source.
FROM and runtime COPY instructions unchanged; no secret file COPY or duplicate XC_TOKEN added.
Documentation warning added in docs/token-bake-warning.md, linked from the README live section.
Kill switch: ALLOW_LIVE_SUBMIT=0.
make test: 59 tests passed. Tests use mock credentials; no real token added to tests.
No commit, push, or tag performed.