Key-pattern redaction of .env output leaks tokens and credentials

A filter like sed -E 's/(PASSWORD|KEY)=(.{6}).*/.../' redacted only those names, so a AWS_BEARER_TOKEN_BEDROCK value and credential IDs were printed in full into the transcript. Partial reveals of six characters also leak secret material. When inspecting a .env the user may have edited, print names only with grep -vE '^\s*#|^\s*$' .env | cut -d= -f1, and show values only for an allowlist of non-secret keys. Treat any secret that reached a transcript as exposed and tell the user to rotate it.