fix(security): resolve js-yaml advisory and clear-text env logging

Pin transitive js-yaml to 4.2.0 via npm overrides (dev toolchain only).
Replace debug dump of the full env object with key names only.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rsaz

package-lock.json

@@ -83,6 +83,9 @@
       "optional": true
     }
   },
+  "overrides": {
+    "js-yaml": "4.2.0"
+  },
   "devDependencies": {
     "@commitlint/cli": "19.6.0",
     "@commitlint/config-conventional": "19.6.0",

package.json

@@ -72,6 +72,7 @@ describe("populate() populate method", () => {
     populate(mockEnvObject, mockParsed, mockOptions as any);
 
     expect(log).toHaveBeenCalledWith('"KEY1" was set to "value1"', LogLevel.Debug);
+    expect(log).toHaveBeenCalledWith("Loaded env keys: KEY1", LogLevel.Debug);
   });
 
   test("should handle empty parsed object gracefully", () => {

src/env/environment.early.spec/populate.early.spec.ts

@@ -346,9 +346,8 @@ export function populate(
     }
   }
 
-  // Final debug log to ensure variables are correctly populated
   if (debug) {
-    console.log("Final process.env object:", envObject);
+    log(`Loaded env keys: ${Object.keys(parsed).join(", ")}`, LogLevel.Debug);
   }
 }