Census approval: sec-sidecar-create-gate

Ruling census-ruling-sec-sidecar-create-gate. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

| unit | change | read sites | what changed | |---|---|---|---| | cmd/console/main.go serve | body | unchanged (3) | serve now parses CARLOSSIDECARACCOUNTS (sidecarAccounts, a pure env parse with log.Fatalf on a bad or empty-list value) before opening anything and passes it into console.Config.SidecarAccounts. No read was added: the same 3 root read sites. |

Envelopes re-pinned: cmd/console, internal/console.

Seal: 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a → 0ca3baafa26f59c0b7d8c6d6a39237d074afb71f885b7fbd50debebab5bf89f2.

Overlay: internal/provision/testdata/plan14-root-reads-sec-sidecar-create-gate.tsv, appended to internal/provision/testdata/plan14-root-reads-chain.tsv.