const DENIED_ENV_VARS: &[&str];
Env var names that must never be overwritten by secret export. Covers dynamic linker, shell execution, path hijack, and privilege escalation vectors.