A credential-named parameter or prop with an unquoted code value
(`session: SessionState,`, `key={turn.requestId + turn.role}`,
`apiKey={settings.apiKey}`) cleared the entropy gate and blocked pushes as
a MEDIUM env.kv finding. One rule replaces the PR's two keyword heuristics:
a value that reads as a code name (no digits, word-like camelCase or dotted
parts) with a code terminator, or a brace expression of such names with no
quoted literal, is source syntax. Paired controls keep firing on quoted,
brace-wrapped, concatenated, YAML-bare and random-letter literals.
Co-authored-by: tianxchen <tianxchen@users.noreply.github.com>
