A readonly bind mount protects the app config, but a late remount from a maintenance script flips the parent mount writable again

Defense in depth existed, yet a broader filesystem action implicitly changed the narrower protection.