A ~/.zshrc read surfaced OP_SERVICE_ACCOUNT_TOKEN into a transcript. The _TOKEN= form was already caught by homelab-env-token, but a bare ops_<b64> value was not. Add an op-service-account rule (ordered early). Tests cover both env-assigned and bare forms. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>