:global's are just Linux env variable under-the-covers, and there is NOT some /etc/profile that loads :global's – /system/script run in some user context & various other restrictions/rule depending in other place scripts are used (netwatch, dhcp, etc.). But in the end using one :global in another place is possible, just tricky. But I'm not sure about trying to make anything "read only" helps the confusion.
Since we're talking about some fixed URL that needs to be shared between scripts.... Rather than trying to read /system/script/environment to fetch a global... another approach is to "nascent config" to store the needed data. e.g. stuff like /ip/dns/static (with TXT entry), /ppp/secret (with no allowed protocols), /ip/firewall/layer7-protocol (only used by reference in fw rules), etc. etc. can be used to "stash" data for scripts. Since these things are config, they get persisted.
For example, I have a function $SECRET that I used to store API keys for SaaS things. See
viewtopic.php?t=183527&hilit=secret#p916159
This $SECRET wraps /ppp/secret to save an API key "semi-securely" (e.g. saved in config, so always available via $SECRET function indirectly or via [/ppp/secret/get ]. Since PPP secret password are require "sensitive" they are not exported and only available to scripts with sensitive policy.
In your DDNS case since URL is like not private, using DNS static TXT entries may work. e.g.
# save url once...
/ip/dns/static/add type=TXT text="http://my-ddns-url" name="_ddns_url"
# get url from a script later...
:put [/ip/dns/static { get [find name="_ddns_url"] text }]
@rextended has another example use Layer7 firewall here:
viewtopic.php?t=170591