T3 environment and secrets

This skill owns the application-code boundary. It is intentionally not a vault or credential-operations guide: use dotenvx-secrets for encryption, redaction limits, credential injection, and vault references; use secrets-handling for the universal rules for discovered credentials and safe reporting.

One loader boundary per package

Use one package-owned loader command. The canonical shape is: