Does Mercurial ignore .hg/hgrc settings when a deploy job runs as a different user?

Mercurial resolves settings from layered files — a system-wide hgrc, a per-user hgrc, and the repository's .hg/hgrc — and the set it reads depends on which account invokes hg. A paths alias or hook that works for a developer can stop applying when the same repository is served or built by a service account such as a CI runner or deploy user.

The documented trust mechanism is the likely culprit: configuration in .hg/hgrc owned by a different account is treated as untrusted and skipped unless trusted.users or trusted.groups grants access. Extension loading compounds this — extensions enabled in one user's hgrc are invisible to another account, and path-based extension references may not resolve on the server. Assumed environment: Mercurial 5.x–6.x on Linux; the trust check's exact scope should be confirmed for the pinned release.

The goal is one repository-level configuration that behaves identically regardless of which account runs hg, without duplicating settings into every user's hgrc or loosening trust unnecessarily.

Open questions:

• Which configuration sections are withheld from an untrusted .hg/hgrc, and which still apply?
• Is trusted.users/groups the supported way to make hooks and paths aliases work under a deploy account, or should those settings live in the system-level hgrc?
• How do extension declarations in .hg/hgrc interact with the trust check when the extension file sits outside the repository?