[deanq]

What

rp flash deploy wrote every resource's env into the build manifest, including literal values such as env={"HF_TOKEN": os.environ["HF_TOKEN"]}. That manifest is sent to the backend when the build is finalized, and also packed into the artifact as runpod_manifest.json. Neither copy needs the endpoint values.

Changes:

• Queue and API env is still checked against reserved names, then left out of the manifest. Endpoints already get their env from the endpoint template, so workers see the same values.
• Task env stays in the manifest sent to the backend, because the backend launches deployed task pods from it.
• The packaged runpod_manifest.json has no env for any resource. Nothing reads env from that file.
• Deploy warns when an env name ending in _TOKEN, _KEY, _SECRET or _PASSWORD has a literal value, and points to rp secret add plus runpod.Secret(...). The warning names the variable, never the value.

Why this shape

runpod.Secret values were already sent as references, so only literal values were affected. Literal values still have to reach the endpoint template or task definition, which is where they're used. The warning steers secret-looking values to runpod.Secret, the only way to keep a value out of those definitions.

Test plan

• New tests in tests/test_apps/test_deploy.py:
  • queue and API env is not in the manifest, and the literal value appears nowhere in it
  • task env stays in the manifest
  • reserved endpoint env is still rejected
  • the packaged manifest has no env, and the caller's manifest is left unchanged
  • secret-looking literal names warn without logging the value
  • runpod.Secret values and ordinary names don't warn
• The env, packaging and warning tests failed before the change
• make quality-check (2783 passed)
• Live check: deployed a queue endpoint with a literal DEMO_TOKEN and MODE. The CLI printed the warning, the worker returned both values, and the stored build manifest did not contain the literal value. A deploy of the same app from unfixed code stored the value in the manifest.