Function is_public_env_path 

pub fn is_public_env_path(path: &str) -> bool

Whether a flattened member path is a PUBLIC env-secret read (process.env.NEXT_PUBLIC_X, import.meta.env.VITE_Y), which must not be recorded as a secret source. Non-env paths (req.query.id) are never public.