Make --dry-run not require secrets

[PRAteek-singHWY]

In --dry-run nothing is sent, so a missing ${ENV} token should not be fatal. Make env interpolation lenient in dry-run only (leave the reference or use a placeholder), while staying strict for real scans.

Files: src/util/env.ts, src/config/load.ts, src/engine/run.ts

Acceptance criteria

• --dry-run succeeds with unset token env vars.
• A real scan still errors loudly on a missing variable.
• Unit test for both paths.

Comment /assign to claim.