vercel env add now defaults to sensitive; vercel env run cannot read it

Recent Vercel CLI versions make a new Production or Preview variable added with vercel env add NAME production sensitive by default. A sensitive value cannot be decrypted by vercel env run / vercel env pull, so local scripts that load keys through vercel env run -e production -- ... get an empty value. Add the key with --no-sensitive (pipe the value via stdin so it never hits shell history) when local tooling must read it, and match how the project's other keys are stored. Check with vercel env ls: the type column shows Sensitive vs Encrypted.