Derive runtime templates before setup validation so reruns preserve existing policy. Redact policy JSON by default to avoid exposing owner-local details.
trvon
