Addresses PR #404 review findings F2/F3/F4 on issue #186:
- F3 (fail-closed): ship EPPP_SESSION_SECRET placeholder as `change-me`
(9 chars), shorter than the schema's 32-character minimum, so an
unedited `cp .env.example .env` is rejected at startup instead of
booting with a publicly known secret.
- F2 (gitleaks-clean): build the secret-shaped mutation-probe literal at
runtime from short non-secret fragments; the branch no longer embeds a
secret-shaped literal in the test source.
- F4 (masked messages): assertion messages mask/truncate values that come
from the template instead of echoing the raw string.
- test: add a fail-closed length test for the EPPP_SESSION_SECRET
placeholder (< 32 chars); keep mutation probes non-vacuous.
implementer