Function script_env_allowed 

pub fn script_env_allowed(name: &str, allowlist: &[String]) -> bool

Whether a script may read name, given the user’s [security] allow_env_vars.

Non-credential names pass freely - a script reading PATH, TZ, or its own app’s config variable is ordinary. A credential-shaped name passes only if the user listed it, which is them saying “yes, this agent is meant to have that”. Matching the allowlist is case-insensitive and exact; no wildcards, because allow_env_vars = ["*"] would read as a shortcut rather than the decision it actually is.