or an outbound call to a trusted endpoint with the env var in a way that can get exposed to the agent via a subsequent call?
How would that work, exactly? What are you envisioning?
It's possible reflected instances are masked too, like GitHub Actions. But I don't know.
How would that work, exactly? What are you envisioning?