Includes changelog entries for secure dotenv operations and envsitter ^0.0.3.
Adds safe matching/scanning endpoints so workflows can validate secrets without reading .env files.