Sensitive Env Vars Should Be Default, Not Opt-In

After getting caught by the Vercel breach, I stopped treating the 'sensitive' flag as something I'd remember to set later. Here's the argument and the minimal workflow change.