fn is_sensitive_leaf_key(leaf_key: &str) -> bool
Returns true if a leaf key name should be considered sensitive and blocked from environment variable overrides.