fix(cli): redact task run env values from debug log

The "initializing task run process" debug log serialized the full worker
environment (fullEnv), including TRIGGER_SECRET_KEY, TRIGGER_JWT, and any
customer secret env vars. Log only the env var names instead of the values.

Author: carderne

.changeset/redact-taskrunprocess-env-log.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Stop logging task run environment variable values at debug level. The `initializing task run process` debug log previously serialized the full worker environment, which includes `TRIGGER_SECRET_KEY`, `TRIGGER_JWT`, and any secret env vars set for the run. It now logs only the env var names, so secrets no longer appear in run logs when debug logging is enabled.

packages/cli-v3/src/executions/taskRunProcess.ts

@@ -150,8 +150,10 @@ export class TaskRunProcess {
       TRIGGERDOTDEV: "1",
     };
 
+    // Only log env var names, never values: fullEnv contains secrets
+    // (TRIGGER_SECRET_KEY, TRIGGER_JWT, and arbitrary customer secret env vars).
     logger.debug(`initializing task run process`, {
-      env: fullEnv,
+      envKeys: Object.keys(fullEnv),
       path: workerManifest.workerEntryPoint,
       cwd,
     });