Harden portable Redmine CLI runtime and cache writes

bin/rtl

@@ -1,9 +1,5 @@
 #!/usr/bin/env bash
-# Muscle-memory wrapper: prod customer-service cache + base URL.
-# Usage: rtl search --where 'assigned_to IS NULL' --max-tickets 10
+# Portable tickets live entry point. No shell evaluation of credentials.
 set -euo pipefail
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-# rtl is the production Redmine wrapper. Keep an explicitly supplied mode, but
-# never silently default its NMI briefs to the dev profile.
-export NMI_MODE="${NMI_MODE:-production}"
-exec "$ROOT/redmine_tickets.py" --config "$ROOT/configs/live.json" "$@"
+ROOT="$(dirname "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")")"
+exec python3 "$ROOT/redmine_cli_runtime.py" tickets live "$@"