Secrets in env_file bypass leak detection

Leak detection reads the compose with docker compose config --no-interpolate to tell a hardcoded secret from a forwarded variable. That read does not expand env_file into the environment block, but the interpolated read the config resolver uses does.

The effect is that a secret pasted into an env_file is served by the config resolver as ordinary non-secret config and is invisible to LeakedSecrets, so lint and validate never flag it. Putting secrets in an env_file is itself an anti-pattern, but ultra should still catch it.

A fix likely needs to compare the interpolated and no-interpolate reads, or read the env_file directly, rather than relying on the no-interpolate output alone.

Start by tracing the config resolver and LeakedSecrets path, then compare the outputs of docker compose config --no-interpolate and the interpolated read for an env_file case. Confirm that a secret supplied through env_file is detected by both lint and validate; the fix is done when it is no longer treated as ordinary non-secret config.

Written by the indexing model from the issue text.