Dynamic env lookups are not seen by lint and provider detection #17

Summary

Credentials read through dynamic lookups are not detected: Ruby ENV[key.to_s.upcase] (pocketrb providers/base.rb:92), Go viper SetEnvPrefix("github") plus GetString("personal_access_token") (github-mcp-server: lint did not flag the PAT at all), Python litellm choosing env vars by model name.

Proposal

This cannot be solved statically, so:

• Document the limitation (README or docs/DIRECTIVES.md), with the @openshell provider directive as the answer.
• Add [providers] expect = ["GITHUB_PERSONAL_ACCESS_TOKEN"] to the config so projects can declare credentials once, and have generate and lint treat them as detected.

Found while testing five real projects (see the local candidate report). Numbered #11 in that report.