Printing an access token into the terminal

Surfaces a command that prints a live credential — gh auth token, npm token list, an echo of a token-shaped variable, a docker login with the password on the command line, or a .netrc dump. Non-blocking, because seeing your own token is sometimes exactly what you need. The status siblings are deliberately NOT matched (gh auth status, npm whoami). It cannot tell whether the output is redirected, and it does NOT match a variable whose name does not contain token, secret, key or password. Global flags between npm/docker and the subcommand are tolerated (npm --silent token list, docker --context <name> login …), and an absolute tool path still matches; gh has no global flag before its subcommand, and a flag that itself runs a program is not read. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt. echo is NOT one of those carriers here, because this rule's own trigger IS an echo: printing a quoted $TOKEN still warns.