mount_config

Build a high-level mount config from provider auth and mount specs.

The returned value is sent as the public mount_config field. The backend expands provider auth into runtime proxy rules.

For S3 mounts, pass the same proxy_config here and to sandbox creation to use its enabled AWS rule. That rule remains general proxy auth; it is not copied into mount-scoped auth or restricted to mount paths. GCS mounts still require explicit GCP authentication in auth.