Struct field mistakenly tagged secret is reported as a phantom secret

The scanner recurses into struct-typed fields and then also evaluates that field's own env and secret tags. caarlos0/env does not populate a plain struct field from a single env var (it descends into it), so a struct field tagged env and secret is a config mistake, but ultra emits the outer name as a real secret in addition to the inner fields.

run and validate then try to resolve a secret that should not exist, producing a confusing resolution failure or an empty injected variable.

A correct fix needs to only treat a struct field as a leaf when its type actually parses from a string (implements a text unmarshaler), mirroring env.Parse, which requires type information beyond the tag.

Start at the scanner logic used by run and validate, then trace how struct fields and env/secret tags are handled alongside env.Parse. Verify the type's text-unmarshaling behavior before classifying a field as a leaf. Done means nested struct secrets remain discoverable, non-parsing outer tags do not create phantom secrets, and run/validate no longer attempt that resolution.

Written by the indexing model from the issue text.