audit-sky-secrets

Scan every .sky for secret-shaped $ENV refs in bash/http not declared in secrets[], report the undeclared ones, exit non-zero on any. Pure bash. Fire via: skyway run audit-sky-secrets --var dir=<path>