Function is_sensitive_file 

pub fn is_sensitive_file(name: &str) -> bool

Returns true if name matches any entry in SENSITIVE_FILES or starts with .env. (catches all dotenv variants). Matching is case-insensitive because macOS and Windows commonly use case-insensitive filesystems.