load_env now tokenizes through agent.secret_scope.load_env_file, which
strips an unquoted ` # ...` tail (dotenv standard; the behaviour the
profile secret scope already had). Pin both halves of the rule so the
value-semantics change is a stated contract, not an accident: unquoted
`abc #123` -> `abc`, quoted `"abc #123"` -> `abc #123`. Hermes' own
writer (_quote_env_value) quotes any value containing `#`, so saved
secrets round-trip.
2ef929dfe0