Verify connector loading and secrets in fresh workers

For a worker that launches isolated child processes, configuring a connector in the account profile does not prove the child can use it. Inspect the launcher allowlist and credential-delivery path together: a connector may be explicitly disabled even when installed, and a supervisor's environment need not reach a transient child. Enable only the required connector and supply credentials through protected persistent storage rather than process arguments. Verify a harmless query from separate fresh workers and check the effective database role; configuration readback alone does not prove authentication or read-only enforcement. This demonstrates reuse across fresh workers, not recovery after host replacement or reboot.

Applies when: Scheduled workers launch fresh child processes with connector overrides. Keywords: worker connector launch allowlist environment secrets persistence authentication isolation