fix(rules): a real literal default inside an env-read expression is not flagged #628

False negatives in code files: Python os.environ.get("X", "hunter2hunter2xx"), JS process.env.X || "hunter2hunter2xx", Rust std::env::var("X").unwrap_or("hunter2hunter2xx".into()). An unquoted RHS in code is treated as an expression, and os.getenv("DB_PASSWORD") also contains a quoted string, so name vs default is hard to tell apart. Direction: recognise the env-read call shapes per language and inspect only the default-argument position.

From the #627 review (KNOWN_GAPS rows in src/engine/secret_heuristics_tests.rs; current behaviour is pinned there).