Flags any direct process.env.X/process.env["X"] read in application code, so environment
access always goes through a capability's own createEnv() contract instead.
Remarks
env.schema.ts/env.schema.tsx files are always exempt (that's where createEnv() itself
reads process.env); the rule's allow option extends that exemption to a consuming
project's own trusted bootstrap code.
Flags any direct
process.env.X/process.env["X"]read in application code, so environment access always goes through a capability's owncreateEnv()contract instead.