pub fn args_reference_secret(args: &Value) -> bool
Whether any string anywhere in a tool’s arguments references a secret / credential path. Used to gate secret reads while context is tainted.